Subject: Re: [TLS] Last Call: <draft-ietf-tls-tls13-24.txt> (The Transport Layer Security (TLS) Protocol Version 1.3) to Proposed Standard

From: Sean Turner <[email-masked]>
Date: Thu, 1 Mar 2018 09:58:42 -0500

I’ve submitted the following PR to make sure we answer IANA questions*:
https://github.com/tlswg/tls13-spec/pull/1159

One thing I’d like to get input on is which of the RSA-PSS signature schemes should be recommended.  The IANA considerations currently recommends rsa_pss_sha256, rsa_pss_sha384, and rsa_pss_sha512. But, we’ve changed the PSS identifiers to split them so now we’ve got different identifiers that follow and we need to make sure we indicate which ones get marked as Recommended:
rsa_pss_rsae_sha256
rsa_pss_rsae_sha384
rsa_pss_rsae_sha512
rsa_pss_pss_sha256
rsa_pss_pss_sha384
rsa_pss_pss_sha512

I believe the intent was that we would specify three rsa_pss_rsae as Recommended.

spt

* IANA does a review of the IANA considerations section to make sure that they understand the requests we’ve made of them.

> On Feb 15, 2018, at 16:13, The IESG <[email-masked]> wrote:
> 
> 
> The IESG has received a request from the Transport Layer Security WG (tls) to
> consider the following document: - 'The Transport Layer Security (TLS)
> Protocol Version 1.3'
>  <draft-ietf-tls-tls13-24.txt> as Proposed Standard
> 
> The IESG plans to make a decision in the next few weeks, and solicits final
> comments on this action. Please send substantive comments to the
> [email-masked] mailing lists by 2018-03-01. Exceptionally, comments may be
> sent to [email-masked] instead. In either case, please retain the beginning of
> the Subject line to allow automated sorting.
> 
> Abstract
> 
> 
>   This document specifies version 1.3 of the Transport Layer Security
>   (TLS) protocol.  TLS allows client/server applications to communicate
>   over the Internet in a way that is designed to prevent eavesdropping,
>   tampering, and message forgery.
> 
> 
> 
> 
> The file can be obtained via
> https://datatracker.ietf.org/doc/draft-ietf-tls-tls13/
> 
> IESG discussion can be tracked via
> https://datatracker.ietf.org/doc/draft-ietf-tls-tls13/ballot/
> 
> The following IPR Declarations may be related to this I-D:
> 
>   https://datatracker.ietf.org/ipr/2900/
> 
> 
> 
> The document contains these normative downward references.
> See RFC 3967 for additional information: 
>    rfc8017: PKCS #1: RSA Cryptography Specifications Version 2.2 (Informational - IETF stream)
> 
> 
>

---

From: Sean Turner <[email-masked]>
Date: Thu, 1 Mar 2018 15:15:11 -0500

I should note that Ben pointed out in the PR that we might need to specify all 6 as recommended.  I can kind of get behind that because before we were doing PSS regardless of the identifier.  Thoughts?

spt

> On Mar 1, 2018, at 09:58, Sean Turner <[email-masked]> wrote:
>

---

From: Benjamin Kaduk <[email-masked]>
Date: Thu, 1 Mar 2018 14:32:14 -0600

To expound a bit more on my thinking, pss_pss is what we actually want
people to be using, thus it should be Recommended, but pss_rsae is what
people are actually going to be using (to large extent), and that is
still a deployment that we consider good and useful, for now.  Maybe in
5 years the IESG can change those "yes"es to "no"s, of course.

-Ben

On 03/01/2018 02:15 PM, Sean Turner wrote:
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls

---

From: Martin Thomson <[email-masked]>
Date: Fri, 2 Mar 2018 08:31:20 +1100

> 5 years the IESG can change those "yes"es to "no"s, of course.

I think that I agree.  For recommendations PSS is fine.  If the
question is MTI, then I think we're stuck with pss_rsae.

---

From: Sean Turner <[email-masked]>
Date: Thu, 1 Mar 2018 19:45:19 -0500

> On Mar 1, 2018, at 16:31, Martin Thomson <[email-masked]> wrote:
> 

I’ll submitted a revised PR [0] to change that will swap out the rsa_pss_sha* with rsa_pss_rsae_sha*:

OLD:

  The following values SHALL be marked as
  "Recommended": ecdsa_secp256r1_sha256, ecdsa_secp384r1_sha384,
  rsa_pss_sha256, rsa_pss_sha384, rsa_pss_sha512, ed25519.

NEW:

  The following values SHALL be marked as
  "Recommended": ecdsa_secp256r1_sha256, ecdsa_secp384r1_sha384,
  rsa_pss_rsae_sha256, rsa_pss_rsae_sha384,rsa_pss_rsae_sha512, and
  ed25519.

spt

[0] https://github.com/tlswg/tls13-spec/pull/1159

---

From: Martin Thomson <[email-masked]>
Date: Fri, 2 Mar 2018 12:05:46 +1100

I think that I was suggesting this:

  The following values SHALL be marked as
  "Recommended": ecdsa_secp256r1_sha256, ecdsa_secp384r1_sha384,
  rsa_pss_rsae_sha256, rsa_pss_rsae_sha384,rsa_pss_rsae_sha512,
  rsa_pss_pss_sha256, rsa_pss_pss_sha384,rsa_pss_pss_sha512, and
  ed25519.

---

From: Sean Turner <[email-masked]>
Date: Thu, 1 Mar 2018 21:11:42 -0500

Okay that was a fail on my part I meant to put all 6 in.  Updated the PR.

spt

> On Mar 1, 2018, at 20:05, Martin Thomson <[email-masked]> wrote:
>