Subject: [TLS] PSS and 1.2

From: Martin Thomson <[email-masked]>
Date: Sun, 24 Jul 2016 11:45:48 +0200

David Benjamin noted that we really need to decide whether PSS was
something that we should have supported in TLS 1.2.  We can't have a
situation where there are two implementations of 1.3 that for some
reason have 1.3 disabled where they disagree whether PSS is
acceptable.

I have opened a PR that makes it clear that PSS is defined for TLS 1.2.

https://github.com/tlswg/tls13-spec/pull/557

---

From: Eric Rescorla <[email-masked]>
Date: Sun, 24 Jul 2016 11:56:13 +0200

I am in favor of this change. We should be trying to move to PSS in general
and there's no reason why 1.3 clients which support PSS can't also support
it for 1.2

-Ekr

On Sun, Jul 24, 2016 at 11:45 AM, Martin Thomson <[email-masked]>
wrote:

> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Ilari Liusvaara <[email-masked]>
Date: Sun, 24 Jul 2016 14:26:31 +0300

> reason have 1.3 disabled where they disagree whether PSS is

My arguing about support for new signature algorithms predated the
crypto negotiation revamp. Back then, one had to assign legacy type
for each TLS 1.3-valid end-entity signature scheme, which for all
practical purposes makes it work in TLS 1.2.

However, since the revamped mechanism entierely dumps legacy types,
it could be possible to have legacy-untyped signatures, which definitely
are not allowed in TLS 1.2 (one could even assign legacy type post-hoc,
which would make it legal for TLS 1.2, but would not affect TLS 1.3
in any way).

However, it is separate matter if backport would make sense for
other reasons...

> I have opened a PR that makes it clear that PSS is defined for TLS 1.2.

The legacy type of RSA-PSS is RSA, right?

-Ilari

---

From: Martin Thomson <[email-masked]>
Date: Sun, 24 Jul 2016 22:35:21 +0200

Actually, I just realized that I should do this anyway.

On 24 July 2016 at 22:33, Martin Thomson <[email-masked]> wrote:
> On 24 July 2016 at 13:26, Ilari Liusvaara <[email-masked]> wrote:
> If I understand you correctly, then yes.  When (if) the proposed
> revamp goes ahead, we will have to qualify this with the note that
> this can only be used with TLS_*_RSA_...  We should probably say
> something about Ed25519 and Ed448 matching ECDSA suites in the same
> way if we decide to backport those too.

---

From: Martin Thomson <[email-masked]>
Date: Sun, 24 Jul 2016 22:33:26 +0200