Subject: [TLS] Using RSA PSS in TLS

From: Johannes Merkle <[email-masked]>
Date: Mon, 14 Oct 2013 10:39:25 +0200

While the current discussion on this list is about ECC, I would like to raise the question if it were not desirable to
allow usage of provably secure RSA-PSS signatures from PKCS#1v2.1 in TLS.

Of course, an issue with this idea is that, if we replace DHE_RSA and ECDHE_RSA with DHE_PSS and ECDHE_PSS, we end up
with a whole bunch of new cipher suites. An alternative could be a new extension signaling the RSA version used (with
PKCS#1v1.5 as default).

Any thoughts on that?
-- 
Johannes

---

From: Hanno Böck <[email-masked]>
Date: Mon, 14 Oct 2013 10:49:12 +0200

On Mon, 14 Oct 2013 10:39:25 +0200
Johannes Merkle <[email-masked]> wrote:

> While the current discussion on this list is about ECC, I would like
> to raise the question if it were not desirable to allow usage of
> provably secure RSA-PSS signatures from PKCS#1v2.1 in TLS.
> 
> Of course, an issue with this idea is that, if we replace DHE_RSA and
> ECDHE_RSA with DHE_PSS and ECDHE_PSS, we end up with a whole bunch of
> new cipher suites. An alternative could be a new extension signaling
> the RSA version used (with PKCS#1v1.5 as default).

Why would you want to allow RSA in non-PSS-mode at all? And why on
earth would you want to make the less secure PKCS#1v1.5 the default?
There's simply zero advantage of PKCS#1v1.5 over PSS, except for legacy
compatibility. But as PKCS#1v2.1 is now out eleven years, we could just
start using it.

I'd say: Preferrably with the next TLS version RSA should simply be
switched to PSS.

-- 
Hanno Böck
http://hboeck.de/

mail/jabber: [email-masked]
GPG: BBB51E42

---

From: Johannes Merkle <[email-masked]>
Date: Mon, 14 Oct 2013 11:23:25 +0200

> Why would you want to allow RSA in non-PSS-mode at all? And why on earth would you want to make the less secure
> PKCS#1v1.5 the default? There's simply zero advantage of PKCS#1v1.5 over PSS, except for legacy compatibility.

legacy compatibility is exactly the point. Implementations must be prepared to communicate to servers / clients that
do not support the new version. (Unfortunately, experience shows that it's not only legacy implementations that do not
implement the latest algorithms; there may be even current ones.) And the absence of an extension is the only way to
detect lack of support for it, thus, the default MUST be the old RSA version.

Otherwise, I agree with your statement that PSS is superior to PKCS#1v1.5 in terms of security. Albeit the security
issues with PKCS#1v1.5 signatures are not that bad as in case of encryption.

> 
> I'd say: Preferrably with the next TLS version RSA should simply be switched to PSS.
> 

Although I would welcome a TLS 1.3 deprecating PKCS#1v1.5 in favor of RSA-PSS, I didn't mean to wait for TLS 1.3.
Given the slow pace of deployment of new TLS versions that may simply take too long.
-- 
Johannes

---

From: Johannes Merkle <[email-masked]>
Date: Mon, 14 Oct 2013 11:29:22 +0200

> with a whole bunch of new cipher suites. An alternative could be a new extension signaling the RSA version used (with

I forgot to mention that PSS introduces additional parameters. RFC 4055 defines
RSASSA-PSS-params  ::=  SEQUENCE  {
         hashAlgorithm      [0] HashAlgorithm DEFAULT
                                   sha1Identifier,
         maskGenAlgorithm   [1] MaskGenAlgorithm DEFAULT
                                   mgf1SHA1Identifier,
         saltLength         [2] INTEGER DEFAULT 20,
         trailerField       [3] INTEGER DEFAULT 1  }

This added flexibility is an even stronger argument for a new extension.

-- 
Johannes

---

From: [email-masked] (Martin Rex)
Date: Mon, 14 Oct 2013 14:12:34 +0200 (CEST)

Johannes Merkle wrote:
>
> While the current discussion on this list is about ECC,
> I would like to raise the question if it were not desirable to
> ECDHE_RSA with DHE_PSS and ECDHE_PSS, we end up
> with a whole bunch of new cipher suites. An alternative could be a
> new extension signaling the RSA version used (with
> PKCS#1v1.5 as default).
> 
> Any thoughts on that?

RSA-PSS would apply only to the DHE_RSA variants, for the vanilla
RSA ciphersuites, one would need RSA-OAEP instead, and it seems
that using a traditional RSA key/cert for both, signature and
encryption is somewhat incompatible with RSA-PSS/RSA-OAEP -- when
signaling is through the AlgorithmIdentifier in SPKI of the
entity certificate.

Having to support two seperate server certificate (different by algorithm)
would have a huge impact on
   - TLS implementations
   - administrative UIs
   - server administration procedures
   - CA procedures

What exactly is the real and serious problem that such a HUGE change
would be trying to fix?

-Martin

---

From: Johannes Merkle <[email-masked]>
Date: Mon, 14 Oct 2013 14:36:03 +0200

> signaling is through the AlgorithmIdentifier in SPKI of the

As I wrote to Santosh, the PSS AlgorithmIdentifier in SPKI is only optional and hardly supported. TLS-Servers should get
a certificate with the usual rsaPublicKey AlgorithmIdentifier in SPKI, which can be used for any RSA operation,
including PSS, OAEP and even signature and encryption according to PKCS#1v1.5.

> What exactly is the real and serious problem that such a HUGE change

No huge change implied by the change.

I admit there is no big issue with old RSA, it it just anticipation of potential future attacks by using a provably
secure algorithm.

-- 
Johannes