Subject: [jose] RSA-PSS salt size

From: Mike Jones <[email-masked]>
Date: Wed, 31 Jul 2013 14:26:40 +0000

It was pointed out to me that we failed to specify the salt size for RSA PSS signatures.  RFC 3447 says that "Typical salt lengths in octets are hLen (the length of the output of the hash function Hash) and 0."  Having looked into it a bit I believe that it would be appropriate for us to specify that the salt length be the same as the output size of the hash function used.  So 256 for PS256, 384 for PS384, and 512 for PS512.

Any disagreement with that choice?

                                                            -- Mike

---

From: Richard Barnes <[email-masked]>
Date: Wed, 31 Jul 2013 18:44:07 +0200

I agree.  Just like with EC key derivation, let's set a conservative
default value for entropy sources.

On Wed, Jul 31, 2013 at 4:26 PM, Mike Jones <[email-masked]>wrote:

>  It was pointed out to me that we failed to specify the salt size for RSA
> PSS signatures.  RFC 3447 says that “Typical salt lengths in octets are
> hLen (the length of the output of the hash function Hash) and 0.”  Having
> looked into it a bit I believe that it would be appropriate for us to
> specify that the salt length be the same as the output size of the hash
> function used.  So 256 for PS256, 384 for PS384, and 512 for PS512.****
>
> ** **
>
> Any disagreement with that choice?****
>
> ** **
>
>                                                             -- Mike****
>
> ** **
>
> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose
>
>