Re: [TLS] TLS 1.3 draft-07 sneak peek

[[e-mail] (Martin Rex)]

Hanno Böck wrote:
> 
> We recently had discussions about DSA and RSA padding modi. The draft
> still contains DSA and wants RSA in the old PKCS #1 1.5 padding
> mode.
> 
> On RSA there was only limited discussion, but I had the impression
> there is hardly an argument for not going with PSS


You seem to believe that RSA-PSS is better than PKCS#1 v1.5 signature
padding.  Could you elaborate why you believe this to be?

It was my impression that RSA-PSS adds complexity and slows down
things and very close to nothing else -- unless you have direct low-level
access to an RSA crypto hardware token and want to extract the RSA
private key from it through the software interface.

A significant amount of TLS usage scenarios do not use dedicated
RSA crypto hardware, and those who don't, will have to pay for RSA-PSS,
but not see any benefit.  And even those that do have the RSA crypto
hardware -- allowing PKCS#1 v1.5 access will be necessary as long
as interop based on TLSv1.0 through TLSv1.2 is still necessary,
which may be quite some time.


-Martin