Re: [TLS] Using RSA PSS in TLS

[Johannes Merkle <[e-mail]>]

> Why would you want to allow RSA in non-PSS-mode at all? And why on earth would you want to make the less secure
> PKCS#1v1.5 the default? There's simply zero advantage of PKCS#1v1.5 over PSS, except for legacy compatibility.

legacy compatibility is exactly the point. Implementations must be prepared to communicate to servers / clients that
do not support the new version. (Unfortunately, experience shows that it's not only legacy implementations that do not
implement the latest algorithms; there may be even current ones.) And the absence of an extension is the only way to
detect lack of support for it, thus, the default MUST be the old RSA version.

Otherwise, I agree with your statement that PSS is superior to PKCS#1v1.5 in terms of security. Albeit the security
issues with PKCS#1v1.5 signatures are not that bad as in case of encryption.

> 
> I'd say: Preferrably with the next TLS version RSA should simply be switched to PSS.
> 

Although I would welcome a TLS 1.3 deprecating PKCS#1v1.5 in favor of RSA-PSS, I didn't mean to wait for TLS 1.3.
Given the slow pace of deployment of new TLS versions that may simply take too long.
-- 
Johannes