Subject: Re: [TLS] RSA-PSS in TLS 1.3

From: Joseph Salowey <[email-masked]>
Date: Wed, 6 Jul 2016 09:23:41 -0800

I don't think we ever call consensus on this topic.  It looks like there is
rough consensus to move forward with RSA-PSS as the MUST implement
algorithm for certificate verify in TLS 1.3 and not allow PKCS-1.5.
During the discussion it also seemed that it is realistic that we may want
to add additional types in the future.  We may want better separation of
signature types of certificates and certificate verify.

Cheers,

J&S

On Wed, Mar 9, 2016 at 2:05 AM, Hubert Kario <[email-masked]> wrote:

> On Tuesday 08 March 2016 18:41:32 Viktor Dukhovni wrote:
> > On Tue, Mar 08, 2016 at 07:24:37PM +0100, Hubert Kario wrote:
> > > No, I said that we have no reason to believe that quantum computers
> > > won't follow exponential increase in number of qbits they can
> > > handle,
> > > with the highest increase not exceeding doubling every year, but
> > > more
> > > likely doubling every two years (as every other technological
> > > development did till now).
> >
> > There's reason to be skeptical of such analogies.  Moore's law was
> > neither a theorem nor a law of nature.  It was an observation about
> > progress in feature-size shrink of silicon transistors.  It is far
> > from clear that evolution of silicon fabrication is a relevant model.
>
> That's why I'm not saying that it will be exactly like Moore's law.
>
> My point is, that processes which have super-exponential growth are the
> exception, not the rule (if they exist at all). And you would be hard
> pressed to find any process in history that experienced exponential
> growth over a long time span and be at the same time vastly faster than
> the Moore's law.
> --
> Regards,
> Hubert Kario
> Senior Quality Engineer, QE BaseOS Security team
> Web: www.cz.redhat.com
> Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic
>
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>
>

---

From: Russ Housley <[email-masked]>
Date: Wed, 6 Jul 2016 13:27:28 -0400

I support a MUST for RSA_PSS for certificate verify, and it does seem like a good idea to be algorithm agile.

Russ

On Jul 6, 2016, at 1:23 PM, Joseph Salowey <[email-masked]> wrote:

> I don't think we ever call consensus on this topic.  It looks like there is rough consensus to move forward with RSA-PSS as the MUST implement algorithm for certificate verify in TLS 1.3 and not allow PKCS-1.5.   During the discussion it also seemed that it is realistic that we may want to add additional types in the future.  We may want better separation of signature types of certificates and certificate verify.  
> 
> Cheers,
> 
> J&S
>

---

From: Andrey Jivsov <[email-masked]>
Date: Wed, 06 Jul 2016 13:16:19 -0700

On 07/06/2016 10:23 AM, Joseph Salowey wrote:
> I don't think we ever call consensus on this topic.  It looks like there
> is rough consensus to move forward with RSA-PSS as the MUST implement
> During the discussion it also seemed that it is realistic that we may
> want to add additional types in the future.  We may want better
> separation of signature types of certificates and certificate verify.  
> 
> Cheers,
> 
> J&S

Was it really the consensus that the group didn't want to allow PKCS-1.5
negotiated for handshake signatures (for certificate verifies)?

TLS 1.3 currently allows this agility for other signatures: the
signatures in X.509 certificates.

Nobody has objections to a MUST implement and MUST prefer RSA-PSS in TLS
1.3.

---

From: Tony Arcieri <[email-masked]>
Date: Wed, 6 Jul 2016 13:57:58 -0700

> negotiated for handshake signatures (for certificate verifies)?

Based on my read of this thread: yes. The consensus seems to be to
disallow PKCS #1 signatures in TLS 1.3.

-- 
Tony Arcieri