Subject: [TLS] PR for PSS support

From: Eric Rescorla <[email-masked]>
Date: Thu, 10 Sep 2015 13:18:24 -0700

https://github.com/tlswg/tls13-spec/pull/239

Based on the WG discussion, I've created a PR for adding support for PSS.
The basic tactic I took is:

- All in-protocol RSA signatures (i.e., in CertificateVerify) are PSS
- You must use MGF1 with  the same hash as you used for the content.
- I added a rsa_pss SignatureAlgorithm field.

The impact of this is that endpoints can sunset support for RSASSA-PKCS1
by omitting it from SignatureAlgorithms.

Note that I didn't deprecate SHA-1 (something Hanno suggested) but I expect
to in another PR based on WG consensus.

Please take a look.

-Ekr

---

From: Russ Housley <[email-masked]>
Date: Thu, 10 Sep 2015 17:07:57 -0400

This text appears in two places (lines 3026 and 3180)

+Only RSA signatures based on RSASSA-PSS MAY be used, regardless of whether
+RSASSA-PKCS-v1_5 appears in "signature_algorithms".

I think it would be better to say:

+RSA signatures MUST be based on RSASSA-PSS, regardless of whether
+RSASSA-PKCS-v1_5 appears in "signature_algorithms".

Russ

---

From: Dave Garrett <[email-masked]>
Date: Thu, 10 Sep 2015 19:28:40 -0400

> to in another PR based on WG consensus.

I've got a PR to deal with SHA-1 deprecation here:

https://github.com/tlswg/tls13-spec/pull/231/files

Dave

---

From: Russ Housley <[email-masked]>
Date: Fri, 11 Sep 2015 11:28:17 -0400

Line 2816 allows SHA-224 in certification paths.  I do not think TLS 1.2 provided that support.

Russ

On Sep 10, 2015, at 7:28 PM, Dave Garrett wrote:

> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls

---

From: Dave Garrett <[email-masked]>
Date: Fri, 11 Sep 2015 15:31:29 -0400

https://tools.ietf.org/html/rfc5246#section-7.4.1.4.1

TLS 1.2 allowed SHA-224. I cut it from TLS 1.3 in draft 08.

https://tools.ietf.org/html/draft-ietf-tls-tls13-08#section-1.2
https://tools.ietf.org/html/draft-ietf-tls-tls13-08#section-6.3.2.1

I see no reason to treat it as worse than SHA-1, so in the pending PR they're both allowed for fallback chains. SHA-1 and SHA-224 would only be permitted if no better chain could be constructed using known supported algorithms via the "signature_algorithms" extension. (and MD5 should always be considered unacceptable)

Dave

---

From: Joseph Salowey <[email-masked]>
Date: Tue, 15 Sep 2015 14:21:38 -0700

I looks like we have consensus to move forward with this PR (PSS), please
apply the change.  I think Russ's suggestion improves the text.

Thanks,

Joe