Re: [TLS] Using RSA PSS in TLS

[Johannes Merkle <[e-mail]>]

Santosh Chokhani schrieb am 14.10.2013 13:21:
> I was in error in the first place.  So, the original question remains of how to tell each other of PSS.

In TLS 1.2, the "signature_algorithms" extension is used to signal the supported / requested signature algorithms by
both client and server. In order to support PSS in that extension, a new code point (or several, depending on the PSS
parameters to be supported) had to be assigned in the corresponding IANA registry.
http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-16

IMO it is not necessary to define new cipher suites. The semantics of "RSA" in cipher suites (and KeyExchangeAlgorithm
indicated in the the server key exchange messages) could be widened to comply with both PKCS#1v1.5 and PSS, and the use
of PSS would be defined eligible only if it has been signaled in the "signature_algorithms" extension by the other peer.
Likewise, the semantics of RSA in the certificate_types field in the Certificate Request message could be clarified that
an rsa key may refer to SPKI rsaPublicKey (general RSA key) as well as to SPKI id-RSASSA-PSS (PSS key), but that
PSS-keys are eligible only if PSS had been listed by the client in the signature_algorithms extension.

Thus, the changes seem limited and backward interoperability would be preserved in the specs.

Although the definition of new code points in the TLS SignatureAlgorithm Registry does not necessarily require a
standards track RFC, I am not sure if the change / extension of existing semantics in TLS 1.2 doesn't require the
standard track anyway.

Johannes