Subject: [Curdle] draft-ietf-curdle-rsa-sha2-05

From: "Mark D. Baushke" <[email-masked]>
Date: Mon, 17 Apr 2017 09:51:33 -0700

Section 5.3 discusses PKCS#1 v1.5 Padding and Signature Verification

It may be desirable to add an informative reference to RFC3447 which
discusses PKCS#1 v2.1 to define RSASSA-PSS vs RSASSA-PKCS1-v1_5.

I know of at least one organization (sogis.org)

http://www.sogis.org/uk/supporting_doc_en.html

In the document:

http://www.sogis.org/documents/cc/crypto/SOGIS-Agreed-Cryptographic-Mechanisms-1.0.pdf

(sections 5.1 and 5.2) which seems to want to disallow RSASSA-PKCS1-v1.5
going forward in the general case.

	-- Mark

---

From: denis bider <[email-masked]>
Date: Wed, 19 Apr 2017 14:10:00 -0600

Hey Mark!

RFC 3447 is obsoleted by RFC 8017, which is currently listed as a normative
reference. It is normative because it's needed to implement the spec.

The reference to RFC 8017 is currently made in section 3 (where the
signature details are defined). Did you mean another reference should be
made to this document in section 5.3? For easier lookup, perhaps?

denis

On Mon, Apr 17, 2017 at 10:51 AM, Mark D. Baushke <[email-masked]> wrote:

> _______________________________________________
> Curdle mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/curdle
>

---

From: "Mark D. Baushke" <[email-masked]>
Date: Wed, 19 Apr 2017 17:29:07 -0700

denis bider <[email-masked]> writes:

> RFC 3447 is obsoleted by RFC 8017, which is currently listed as a
> normative reference. It is normative because it's needed to implement
> the spec.

Oops. Mea Culpa. You are correct.

> made to this document in section 5.3? For easier lookup, perhaps?

My issue is that PSS is ambiguous in Section 5.3, 'PSS' is also known as
RSASSA-PSS (RFC 8017 Section 8.1) which is not to be confused with
EMSA-PSS (RFC 8017 section 9.1).

	-- Mark

---

From: denis bider <[email-masked]>
Date: Mon, 24 Apr 2017 15:31:32 -0600

Thanks. :-)

I have clarified this in today's updated version, which also addresses some
nits.