Subject: [COSE] [cose-issues] Add RSA v1.5 Signature to the set of accepted algorithms (#5)

From: Jim Schaad <[email-masked]>
Date: Wed, 12 Aug 2015 21:54:39 -0700

Moving this issue from the internal tracker because it has not been resolved in discussions on the list.

Does COSE need to have RSA v1.5 signatures added as an algorithm in the base specification?  

Pro:  People seem to think that RSA-PSS is not sufficiently wide spread so that if RSA is going to be supported then v1.5 needs to be supported.  There are enough recognized attacks against v1.5 encryption that nobody thinks it should be kept.

Con:  RSA told us almost 15 years ago to stop using it, use RSA-PSS instead.  Yes there are no known attacks against it, but if we don't switchover now when are we going to do so.

Don't Care:  Everybody, especially in constrained environments, are going to use ECDSA if they use any signature algorithm so who cares what the decision is.

People commenting in the email discussion: 3  (two of which are the editors)

Punt this issue off until sometime in october.

---
Reply to this email directly or view it on GitHub:
https://github.com/cose-wg/cose-issues/issues/5