Subject: [Unbearable] Do we strip leading 0's on modulus and exponent?

From: Bill Cox <[email-masked]>
Date: Thu, 14 Jul 2016 09:18:05 -0700

I'm just finishing converting to the new custom token-binding format (which
was fairly painful).  One think I would like to see is that there is one
unique encoding for any given key or signature.  I think we succeeded in
this for ECDSA-P256, and for RSA signatures (which are 32 bytes long
always), but it is not clear to me from the spec whether or not to strip
leading 0's on the RSA modulus and exponent in RSA keys.  My guess is that
yes, we need to strip them, so that there is only one unique way to
represent an RSA key.  Is this right?  Either way, I think we should
specify this in the spec.

Thanks,
Bill

---

From: Andrei Popov <[email-masked]>
Date: Thu, 14 Jul 2016 21:51:17 +0000

I’m leaning towards having a TB implementation accept the 0-padding, if provided by the peer. Crypto libraries differ in how they represent RSA keys, and if stripping the zeros results in additional memory copies, I’d rather avoid that.

Cheers,

Andrei

From: Unbearable [mailto:[email-masked]] On Behalf Of Bill Cox
Sent: Thursday, July 14, 2016 9:18 AM
To: Tokbind WG <[email-masked]>
Subject: [Unbearable] Do we strip leading 0's on modulus and exponent?

I'm just finishing converting to the new custom token-binding format (which was fairly painful).  One think I would like to see is that there is one unique encoding for any given key or signature.  I think we succeeded in this for ECDSA-P256, and for RSA signatures (which are 32 bytes long always), but it is not clear to me from the spec whether or not to strip leading 0's on the RSA modulus and exponent in RSA keys.  My guess is that yes, we need to strip them, so that there is only one unique way to represent an RSA key.  Is this right?  Either way, I think we should specify this in the spec.

Thanks,
Bill