Re: [TLS] RSASSA-PSS in certificates and "signature_algorithms"

[[e-mail] (Martin Rex)]

Ilari Liusvaara wrote:
> On Tue, Sep 12, 2017 at 01:02:19PM +0200, Martin Rex wrote:
>> 
>> A new TLS extension to convey acceptable signatures on certs would be
>> needed, and for this, it would be preferable to pass along ASN.1
>> OIDs from AlgIds (not full AlgIds, this would be too messy with RSA-PSS).  
> 
> With RSA-PSS, there is also the parametrization signature by hashes.
> 
> The implementation I have supports the following six sets of parameters
> for RSA-PSS:
> 
> - hash=SHA-256, mgf=MGF1[SHA-256], salt=256, trailer=1
> - hash=SHA-384, mgf=MGF1[SHA-384], salt=384, trailer=1
> - hash=SHA-512, mgf=MGF1[SHA-512], salt=512, trailer=1
> - hash=SHA3-256, mgf=MGF1[SHA3-256], salt=256, trailer=1
> - hash=SHA3-384, mgf=MGF1[SHA3-384], salt=384, trailer=1
> - hash=SHA3-512, mgf=MGF1[SHA3-512], salt=512, trailer=1


The salt length is supposed to be in bytes, not bits, and for SHA-1
defaults to 20.  The salt length suggested in the standard is the
output size of the underlying hash length in bytes.

But it seems that some existing implementations use weird/unusual salt
values for RSA-PSS signature with hash algs other than SHA-1.

-Martin