Subject: [Cfrg] Reference for hash substitution attack against RSASSA-PSS and its mitigation

From: Mike Jones <[email-masked]>
Date: Fri, 2 Jun 2017 20:06:25 +0000

Is there a paper that describes the theoretical hash substitution attacks against RSASSA-PSS and how they are mitigated?

                                                                Thanks,
                                                                -- Mike

---

From: Dan Brown <[email-masked]>
Date: Mon, 5 Jun 2017 14:03:43 +0000

Just a guess: perhaps this old presentation by Kaliski:

http://grouper.ieee.org/groups/1363/Research/contributions/HashFunctionFirewalls.pdf

is relevant?

Probably even more off-topic: as I recall, the standardized version of PSS pre-hashes the message, whereas the original academic Bellare-Rogaway version does not.  The difference between the standard and the academic version is a little like the difference between Schnorr and DSA-style signatures.  So, for standard PSS, the hash must resist collisions, pre-images, etc., whereas for the original PSS, perhaps much less is needed from hash (the proof assumes a super-strong hash, of course).  I suppose that this in turn may be a concern for hash substitutions ...

From: Cfrg [mailto:[email-masked]] On Behalf Of Mike Jones
Sent: Friday, June 2, 2017 4:06 PM
To: [email-masked]
Cc: Steve KENT <[email-masked]>
Subject: [Cfrg] Reference for hash substitution attack against RSASSA-PSS and its mitigation

                                                                Thanks,
                                                                -- Mike