Subject: Re: [Cfrg] Reference for hash substitution attack against RSASSA-PSS and its mitigation

From: "Paterson, Kenny" <[email-masked]>
Date: Sun, 4 Jun 2017 19:28:41 +0000

Hi Mike,

I'm not sure what attacks you're referring to here, so could you briefly
summarise them for me? That might help me and others figure out if there's
a suitable research paper to point you towards.

Thanks,

Kenny 

On 02/06/2017 21:06, "Cfrg on behalf of Mike Jones" <[email-masked]
on behalf of [email-masked]> wrote:

>Is there a paper that describes the theoretical hash substitution attacks
>against RSASSA-PSS and how they are mitigated?
> 
>                                                                Thanks,
>                                                                -- Mike
> 
>

---

From: Mike Jones <[email-masked]>
Date: Mon, 5 Jun 2017 06:05:38 +0000

This text was written for Security Considerations about using RSASSA-PSS:

There is a theoretical hash substitution attack that can be mounted against RSASSA-PSS. However, the requirement that the same hash function be used consistently for all operations is an effective mitigation against it. Unlike ECDSA, hash function outputs are not truncated so that the full hash value is always signed. The internal padding structure of RSASSA-PSS means that one needs to have multiple collisions between the two hash functions to be successful in producing a forgery based on changing the hash function. This is highly unlikely.

If there’s a suitable reference to these attacks, that would be great.  Or if even saying this is misguided or out of place, that would be useful to know too.

                                                       Thanks,

                                                       -- Mike

-----Original Message-----
From: Paterson, Kenny [mailto:[email-masked]]
Sent: Sunday, June 4, 2017 12:29 PM
To: Mike Jones <[email-masked]>; [email-masked]
Cc: Steve KENT <[email-masked]>
Subject: Re: [Cfrg] Reference for hash substitution attack against RSASSA-PSS and its mitigation

Hi Mike,

I'm not sure what attacks you're referring to here, so could you briefly summarise them for me? That might help me and others figure out if there's a suitable research paper to point you towards.

Thanks,

Kenny

On 02/06/2017 21:06, "Cfrg on behalf of Mike Jones" <[email-masked] on behalf of [email-masked]<mailto:[email-masked][email-masked]>> wrote:

>Is there a paper that describes the theoretical hash substitution

>attacks against RSASSA-PSS and how they are mitigated?