Re: [TLS] Remove signature algorithms from cipher suites in 1.3

[Antoine Delignat-Lavaud <[e-mail]>]

Hi,

Le 12/23/2014 10:26 AM, Hanno Böck a écrit :
> Do I understand your proposal right that it'd result in:
>
> a) If we use the normal RSA certificates we have today TLS 1.3 would
> continue using RSA-PKCS#1v1.5
> b) If the user gets a designated RSA-PSS key/certificate it'd use PSS?
>
> I think this would result in a near-zero-adoption for PSS probably for
> a very long time because you'd depend on the CA to do anything.

No, in my proposal, the algorithm used in CertificateVerify messages is 
negotiated based on advertised support in the "signature algorithms" 
extension (and supported_signature_algorithms field in 
CertificateRequest). Clients are encouraged to prioritize rsa-pss/sha256 
over rsa/sha256 or rsa/sha1, and supporting servers may pick PSS even if 
their certificate chain only contains rsa/sha256 and rsa/sha1.

> (Please note that the algorithm identifier for PSS already exists for
> X509, it's RFC 4055. It allows Keys with an algorithm identifier
> restricting to PSS, but that's no requirement - you can use the old
> keys for PSS as well, as technically they're no different.)

If anything, my own concern is the opposite. Allowing the same RSA key 
to be used to sign with both PSS and PKCS#1v1.5 is considered 
cryptographic malpractice, as the composition of secure and weak 
signatures may very well be broken. However, servers have the ability to 
avoid this risk by sending a different certificate depending on whether 
the client advertises support for PSS or not, even if the two 
certificates are signed with PKCS#1 (the proof of the protocol will 
probably assume servers enforce this behavior).

Furthermore, one of the issues of PSS in RFC 4055 is its reliance on 
signature parameters, which have tricky agility characteristics. For 
everyone's sake, it may help adoption if new OIDs for PSS signatures 
were used that correspond to fixed parameters. In any case, this 
discussion is out of the scope of the TLS WG.

Best,

Antoine