Re: [TLS] Case for negotiation of PKCS#1.5 RSASSA-PKCS1-v1_5 in TLS 1.3

Sean Turner <sean@sn3rd.com> Mon, 25 January 2016 17:31 UTC

Return-Path: <sean@sn3rd.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ACBDD1B3798 for <tls@ietfa.amsl.com>; Mon, 25 Jan 2016 09:31:18 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.001
X-Spam-Level:
X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QRLj01r7KpJQ for <tls@ietfa.amsl.com>; Mon, 25 Jan 2016 09:31:16 -0800 (PST)
Received: from mail-yk0-x234.google.com (mail-yk0-x234.google.com [IPv6:2607:f8b0:4002:c07::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1EBC11B3794 for <tls@ietf.org>; Mon, 25 Jan 2016 09:31:16 -0800 (PST)
Received: by mail-yk0-x234.google.com with SMTP id u68so40303534ykd.2 for <tls@ietf.org>; Mon, 25 Jan 2016 09:31:16 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=content-type:mime-version:subject:from:in-reply-to:date :content-transfer-encoding:message-id:references:to; bh=KOxSeZubhD8T4ADB+2wmRanCTnf9j30Gqcm7YF7+98U=; b=bbV6dxxDR+QovKCXwj9cNi6Ip6GxYrRgfQ2KxxkN9OWGTXaaGd7hPzp/hxpSQvoAZs K38D6t8FtYSi4w490mqyefapc2Ed8cY8g6n3eecyhoowXwbo06qneePa00MBMUncfdVS E1SI3ua16NRcojAbohlNaE9CVXe6CWErmVaSQ=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:content-type:mime-version:subject:from :in-reply-to:date:content-transfer-encoding:message-id:references:to; bh=KOxSeZubhD8T4ADB+2wmRanCTnf9j30Gqcm7YF7+98U=; b=PF54NyModA2fuFpjBJ8fXbZJPrB+oHWwhl3bgwRPEeqt3YZYdzYuMMUhO4vO/LO3cl a1bB2WYx/CSXVjMztqod8QHrjBQsowSDOP25MwogbuePzuIN56jtKDXXxaO52lVFZosX FTHtW2h40L595hStS2gIP6t50fYcANOxweUXzRHM25ZOSstjC/4mKcVHQ15cdSkrCi6l HTQAQiixyyodHFqMtMf/njszQ5LObT50+xx+pS7HxhZ0814ZD27KnWTzC21YRy9HsDXS e9GC2trE0Y8hxOizmJO84W+F08Z32A2kOOx6RQK+QGtYLzTF/BuToNe0Cw1xfZXHLhEy 4RQA==
X-Gm-Message-State: AG10YOS82vBTS2ZlndCgg4QT23llWShs2O2hv4I7i3HcwQCWTdSvzNURrLXCAeLsSYnm3w==
X-Received: by 10.37.97.66 with SMTP id v63mr9687380ybb.71.1453743075386; Mon, 25 Jan 2016 09:31:15 -0800 (PST)
Received: from [172.16.0.112] ([96.231.217.211]) by smtp.gmail.com with ESMTPSA id v130sm14839809ywe.24.2016.01.25.09.31.14 for <tls@ietf.org> (version=TLS1 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 25 Jan 2016 09:31:14 -0800 (PST)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 9.2 \(3112\))
From: Sean Turner <sean@sn3rd.com>
In-Reply-To: <56A192FC.4060206@brainhub.org>
Date: Mon, 25 Jan 2016 12:31:13 -0500
Content-Transfer-Encoding: quoted-printable
Message-Id: <6AAFF82D-8F1D-4B0C-9E3C-A1FEE5D46748@sn3rd.com>
References: <56A192FC.4060206@brainhub.org>
To: "tls@ietf.org" <tls@ietf.org>
X-Mailer: Apple Mail (2.3112)
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/mNRS2G13DlMQy1saqk3ikXETBUU>
Subject: Re: [TLS] Case for negotiation of PKCS#1.5 RSASSA-PKCS1-v1_5 in TLS 1.3
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 25 Jan 2016 17:31:18 -0000

All,

Andrey sent this message at the chairs' request to make sure that we adequately discussed the issue, which we discussed at the last IETF meeting (https://www.ietf.org/proceedings/94/slides/slides-94-tls-4.pdf).

spt

> On Jan 21, 2016, at 21:25, Andrey Jivsov <crypto@brainhub.org>; wrote:
> 
> Current draft of TLS 1.3 [1] mandates RSA-PSS in TLS handshake by the following language in sec 4.8.1
> 
>>    In RSA signing, the opaque vector contains the signature generated
>>    using the RSASSA-PSS signature scheme defined in [RFC3447  <http://tools.ietf.org/html/rfc3447>] with MGF1.
>>    The digest used in the mask generation function MUST be the same as
>>    the digest which is being signed (i.e., what appears in
>>    algorithm.signature).  The length of the salt MUST be equal to the
>>    length of the digest output.  Note that previous versions of TLS used
>>    RSASSA-PKCS1-v1_5, not RSASSA-PSS.
> 
> The
> 
>>       struct {
>>          SignatureAndHashAlgorithm algorithm;
>>          opaque signature<0..2^16-1>;
>>       } DigitallySigned;
> 
> defines RSA PKCS#1 1.5 and RSA PSS as "rsa" and "rsapss", see sec A.3.1.1:
> 
>>       enum {
>>           rsa(1),
>>           dsa(2),
>>           ecdsa(3),
>>           rsapss(4),
>>           eddsa(5),
>>           (255)
>>       } SignatureAlgorithm;
> 
> since draft -09 (posted Oct 2015). "rsa" applies to X.509 certificates only.
> 
> 
> Many implementers of TLS 1.3 expressed desire for the TLS 1.3 to be as frictionless as possible regarding the upgrade of existing TLS installations to TLS 1.3. We should expect that all TLS 1.3 servers and clients will have support for older versions of TLS on the same node. Ideally, it should be possible to upgrade the software / firmware to add TLS 1.3 support on existing hardware with minimal penalty.
> 
> Unfortunately, the product I work on, which is responsible for ~15% of Internet traffic, is not compatible with the "frictionless idea" due to the current TLS 1.3 spec [1] mandating PSS in the handshake.
> 
> The issue here is that these already sold products use 3d party components that can only perform RSA signing with CRT optimization when the padding is PKCS1 1.5. In the best case this means ~2x performance penalty for TLS 1.3. In the worst case the existing server keys cannot do PSS signature if the keys are on FIPS-certified devices.
> 
> The same issue applies to client TLS authentication with smartcards. Many smartcards cannot do PSS, e.g. [3].
> 
> Likewise, it's unclear if PSS is supported by e.g. PKCS#11 libraries of HSM vendors, or the HSM hardware.
> 
> Other products on the Internet use the same components, so that 15% is a minimum I know of.
> 
> The current list of FIPS 140 products that support RSA shows twice as many products that support RSASSA-PKCS1_V1_5 than these that support RSASSA-PSS [4]. There is greater than 50% chance to lose FIPS certification with TLS 1.3, factoring client auth and servers.
> 
> Can support for PSS be added by 3d party vendors? If the limitation is in middleware like PKCS#11 or in firmware/microcode, this is technically possible. This does require an update and the brings version dependency. Further, if the firmware is FIPS 140-2 certified, this type of upgrade will have re-certification cost (more friction). In some cases this is a physical limitation. For example, I know from my experience working on smartcard decryption a few years back that the chips themselves insist on PKCS#1.5 padding for half of the vendors we supported and won't e.g. accept raw or OAEP padding with RSA, e.g. [2]. It is apparent from the specs that [3] does support PSS while [2] doesn't.
> 
> I prepared the slides on this subject for Yokohama [5]. I believe Eric Rescorla presented these.
> 
> How much do the members of the WG value the idea of lower hurdles to the deployment of TLS 1.3? Is there desire to add a PKCS#1 1.5 signature fallback, just like there is one already for X.509 certificates in TLS 1.3?
> 
> The only solution that's available at this point is conditioning TLS 1.3 support on appropriate hardware. For this reason TLS 1.3 it probably won't be enabled by default in the product I work on. I would prefer for TLS 1.3 to be enabled by default and write the code to decide whether it does PSS or falls back to RSA PKCS1 1.5.
> 
> Thank you.
> 
> [1] http://tools.ietf.org/html/draft-ietf-tls-tls13-11.html
> [2] 4.4 has no PSS: http://jp.atos.net/content/dam/global/we-do/cardos-datenblatt.pdf
> [3] 5.0 has PSS: https://atos.net/content/dam/global/we-do/cardos-v5-datenblatt.pdf
> 
> [4] 2x more legacy than PSS: http://csrc.nist.gov/groups/STM/cavp/documents/dss/rsanewval.html
> wget http://csrc.nist.gov/groups/STM/cavp/documents/dss/rsanewval.html
> $ grep RSASSA-PSS rsanewval.html | wc -l
> 593
> $ grep RSASSA-PKCS1_V1_5 rsanewval.html | wc -l
> 2005
> $ grep RSASSA rsanewval.html | wc -l
> 2607
> 
> [5] https://www.ietf.org/proceedings/94/slides/slides-94-tls-4.pdf https://www.ietf.org/jabber/logs/tls/2015-11-04.html
> 
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls