Subject: [lamps] RFC5754: Need clarification on AlgorithmIdentifier.parameters of hash algorithms in RSASSA-PSS-params

From: Lijun Liao <[email-masked]>
Date: Thu, 11 Mar 2021 15:46:41 +0100

RFC 5754 specifies that the implementation should generate the
AlgorithmIdentifier for SHA-2 in CMS with absent parameters.

It is unclear whether this also applies to the hash algorithms in the
RSASSA-PSS-params (defined in PKCS#1, RFC 8017), if RSASSA-PSS signature is
used in the CMS. If yes, then it conflicts with RFC 8017; and if not then
there are two different encodings of the same hash algorithm in the same
document.

For the RSASSA-PSS-params, openssl (tested with the version 1.1.x) does not
contain the parameters field, while the BouncyCastle adds the NULL
parameters.

So we need clarification on this issue.

Best regards

Lijun Liao

---

From: Russ Housley <[email-masked]>
Date: Thu, 11 Mar 2021 16:18:41 -0500

Lijun:

There are two possible encodings for the AlgorithmIdentifier parameters field.  The two alternatives arise from the fact that when the 1988 syntax for AlgorithmIdentifier was translated into the 1997 syntax, the OPTIONAL associated with the AlgorithmIdentifier parameters got lost.  Later, the OPTIONAL was recovered via a defect report, but by then many people thought that algorithm parameters were mandatory.  Because of this history some implementations encode parameters as a NULL element and others omit them entirely.  In my view, the correct encoding for the SHA-224, SHA-256, SHA-384, and SHA-512 message digest algorithms is to omit the parameters field; however, to ensure compatibility, implementations ought to also handle a AlgorithmIdentifier parameters field that contains a NULL.

Russ

> On Mar 11, 2021, at 9:46 AM, Lijun Liao <[email-masked]> wrote:
> 
> RFC 5754 specifies that the implementation should generate the AlgorithmIdentifier for SHA-2 in CMS with absent parameters.
> 
> It is unclear whether this also applies to the hash algorithms in the RSASSA-PSS-params (defined in PKCS#1, RFC 8017), if RSASSA-PSS signature is used in the CMS. If yes, then it conflicts with RFC 8017; and if not then there are two different encodings of the same hash algorithm in the same document.
> 
> For the RSASSA-PSS-params, openssl (tested with the version 1.1.x) does not contain the parameters field, while the BouncyCastle adds the NULL parameters. 
>

---

From: Lijun Liao <[email-masked]>
Date: Thu, 11 Mar 2021 22:44:31 +0100

Russ,

the receiver, as you describe, should omit the parameters field.

But what is the correct behavior for the implementation to generate the CMS
messages?

Lijun

Russ Housley <[email-masked]> schrieb am Do., 11. März 2021, 22:18:

> Lijun:
>
> There are two possible encodings for the AlgorithmIdentifier parameters
> field.  The two alternatives arise from the fact that when the 1988 syntax
> for AlgorithmIdentifier was translated into the 1997 syntax, the OPTIONAL
> associated with the AlgorithmIdentifier parameters got lost.  Later, the
> OPTIONAL was recovered via a defect report, but by then many people thought
> that algorithm parameters were mandatory.  Because of this history some
> implementations encode parameters as a NULL element and others omit them
> entirely.  In my view, the correct encoding for the SHA-224, SHA-256,
> SHA-384, and SHA-512 message digest algorithms is to omit the parameters
> field; however, to ensure compatibility, implementations ought to also
> handle a AlgorithmIdentifier parameters field that contains a NULL.
>
> Russ
>
>
> > For the RSASSA-PSS-params, openssl (tested with the version 1.1.x) does
> not contain the parameters field, while the BouncyCastle adds the NULL
> parameters.
> >

---

From: Russ Housley <[email-masked]>
Date: Thu, 11 Mar 2021 17:45:51 -0500

I think that Section 2 of RFC 5754 is very clear.  It says:

   Implementations MUST generate SHA2
   AlgorithmIdentifiers with absent parameters.

Russ

> On Mar 11, 2021, at 4:44 PM, Lijun Liao <[email-masked]> wrote:
> 
> Russ,
> 
> But what is the correct behavior for the implementation to generate the CMS messages?
> 
> Lijun
> 
> Russ Housley <[email-masked] <mailto:[email-masked]>> schrieb am Do., 11. März 2021, 22:18:
> Lijun:
> 
> > On Mar 11, 2021, at 9:46 AM, Lijun Liao <[email-masked] <mailto:[email-masked]>> wrote:
> > 
> _______________________________________________
> Spasm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spasm

---

From: Russ Housley <[email-masked]>
Date: Thu, 11 Mar 2021 19:18:34 -0500

For places where these algorithms are used by themselves, such as the DigestAlgorithms field in CMS, I think that Section 2 of RFC 5754 is very clear.  It says:

Since you asked about RSASSA, RFC 4055 is also relevant.  When these algorithms appear in the parameters of id-RSASSA-PSS, the NULL parameter is required.  RFC 4055 says:

   To be clear, the following algorithm identifiers are used when a NULL
   parameter MUST be present:

      sha1Identifier  AlgorithmIdentifier  ::=  { id-sha1, NULL }
      sha224Identifier  AlgorithmIdentifier  ::=  { id-sha224, NULL }
      sha256Identifier  AlgorithmIdentifier  ::=  { id-sha256, NULL }
      sha384Identifier  AlgorithmIdentifier  ::=  { id-sha384, NULL }
      sha512Identifier  AlgorithmIdentifier  ::=  { id-sha512, NULL }

Russ

> On Mar 11, 2021, at 4:44 PM, Lijun Liao <[email-masked] <mailto:[email-masked]>> wrote:
> 
> Russ,
> 
> [email-masked] <mailto:[email-masked]>