Subject: RSA PSS in SSH?

From: Hanno Böck <[email-masked]>
Date: Mon, 22 Nov 2010 00:00:01 +0100

Hi,

According to RFC 4253, secure shell uses the old RSASSA-PKCS1-v1_5 padding 
scheme for RSA signatures.

Are there any plans for a transition to RSASSA-PSS (as specified in pkcs #1 
2.1)?

(I saw that RFC 4253 already specifies the use of RSA-OAEP for encrypted key 
exchange)

-- 
Hanno Böck		Blog:		http://www.hboeck.de/
GPG: 3DBD3B20		Jabber/Mail:	[email-masked]

http://schokokeks.org - professional webhosting

---

From: [email-masked] (Niels Möller)
Date: Mon, 22 Nov 2010 12:42:33 +0100

> Are there any plans for a transition to RSASSA-PSS (as specified in pkcs #1 

Not that I am aware of.

> (I saw that RFC 4253 already specifies the use of RSA-OAEP for encrypted key 

My understanding is that the pkcs#1 v1.5 padding is a much more severe problem for
encryption than for signing, mostly related to chosen ciphertext attacks.

But I'm not a cryptologist. How important is it to obsolete v1.5 padding
for signatures? What attacks are there?

Regards,
/Niels

-- 
Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26.
Internet email is subject to wholesale government surveillance.

---

From: Hanno Böck <[email-masked]>
Date: Mon, 22 Nov 2010 13:10:20 +0100

Am Monday 22 November 2010 schrieb Niels Möller:
> My understanding is that the pkcs#1 v1.5 padding is a much more severe
> problem for encryption than for signing, mostly related to chosen
> ciphertext attacks.
> 

There are no attacks. It's purely an extra-safety measure.

PSS has two advantages: First, it provides a security "proof" under the 
asumption that the RSA problem itself is hard and the random oracle model. 
Roughly speaking, PKCS #1 1.5 padding has no known flaws, but you can't proove 
that it doesn't have flaws - with PSS, you can.

The other thing is that PSS adds randomization - this often makes 
implementation flaws harder to exploit (for example fault-based attacks).

So there is no high pressure on implementing PSS, but it is a useful extra 
security measure on the long term.