Subject: [TLS] [Errata Verified] RFC8422 (5703)

From: RFC Errata System <[email-masked]>
Date: Wed, 1 May 2019 10:01:39 -0700 (PDT)

The following errata report has been verified for RFC8422,
"Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) Versions 1.2 and Earlier". 

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata/eid5703

--------------------------------------
Status: Verified
Type: Technical

Reported by: Frank Theinen <[email-masked]>
Date Reported: 2019-04-23
Verified by: Benjamin Kaduk (IESG)

Section: 5.10.

Original Text
-------------
All RSA signatures must be generated and verified according to
   Section 7.2 of [RFC8017].

Corrected Text
--------------
All RSA signatures must be generated and verified according to
   Section 8.2 of [RFC8017].

Notes
-----
Section 7.2 of RFC 8017 describes the RSAES-PKCS1-v1_5 encryption scheme. Section 8.2 of RFC 8017 describes the RSASSA-PKCS1-v1_5 signature scheme. The original text contradicts the natural expectation and is probably wrong. If it was intended, there should have been a thorough explanation (like in the well-known case of IKEv1 using the encryption scheme for signing).

--------------------------------------
RFC8422 (draft-ietf-tls-rfc4492bis-17)
--------------------------------------
Title               : Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) Versions 1.2 and Earlier
Publication Date    : August 2018
Author(s)           : Y. Nir, S. Josefsson, M. Pegourie-Gonnard
Category            : PROPOSED STANDARD
Source              : Transport Layer Security
Area                : Security
Stream              : IETF
Verifying Party     : IESG

---

From: Peter Gutmann <[email-masked]>
Date: Wed, 1 May 2019 17:14:16 +0000

RFC Errata System <[email-masked]> writes:

>Section 7.2 of RFC 8017 describes the RSAES-PKCS1-v1_5 encryption scheme.
>Section 8.2 of RFC 8017 describes the RSASSA-PKCS1-v1_5 signature scheme. The
>original text contradicts the natural expectation and is probably wrong.

The original text is correct, TLS 1.2 (and earlier) use PKCS #1 v1.5.  Stating
that RSA-PSS should be used is wrong.

Peter.

---

From: Benjamin Kaduk <[email-masked]>
Date: Wed, 1 May 2019 12:17:47 -0500

> that RSA-PSS should be used is wrong.

Section 7.2 is an encryption scheme, not a signature scheme; this is just a
typo.

(And RSASSA-PKCS1-v1_5 is, well, PKCS #1 v1.5, not RSASSA-PSS.)

-Ben

---

From: Peter Gutmann <[email-masked]>
Date: Wed, 1 May 2019 17:19:41 +0000

>(And RSASSA-PKCS1-v1_5 is, well, PKCS #1 v1.5, not RSASSA-PSS.)

Ah, sorry, I saw all the SS's and read it as PSS :-).

Peter.