Subject: [Unbearable] RSA padding schemes

From: Pranav Kukreja <[email-masked]>
Date: Fri, 19 Aug 2016 22:30:54 +0000

The RSA key information about padding needs more details on Page 6.

/*When an rsa2048_pkcs1.5 or rsa2048_pss key is used,

   TokenBinding.signature contains the signature generated using,

   respectively, the RSASSA-PKCS1-v1_5 or RSASSA-PSS signature scheme

   defined in [RFC3447].  RSAPublicKey.modulus and

   RSAPublicKey.publicexponent contain the length-prefixed modulus and

   exponent of the RSA public key represented in big-endian format.*/

Specifically we should mention that the padding hash algorithm used for both RSA key types is SHA256 and we need to also close on the salt length for PSS padding.

*RFC3447* mentions the typical salt lengths, if using 0 is easier and has no adverse security effect, we could use that.

  /*
4. Typical salt lengths in octets are hLen (the length of the output
      of the hash function Hash) and 0.  In both cases the security of
      RSASSA-PSS can be closely related to the hardness of inverting
      RSAVP1.  Bellare and Rogaway [4] give a tight lower bound for the
      security of the original RSA-PSS scheme, which corresponds roughly
      to the former case, while Coron [12] gives a lower bound for the
      related Full Domain Hashing scheme, which corresponds roughly to
      the latter case.  In [13] Coron provides a general treatment with
      various salt lengths ranging from 0 to hLen; see [27] for
      discussion.  See also [31], which adapts the security proofs in
      [4][13] to address the differences between the original and the
      present version of RSA-PSS as listed in Note 1 above.
*/

Thanks
Pranav

---

From: Andrei Popov <[email-masked]>
Date: Sat, 20 Aug 2016 01:45:26 +0000

Opened GitHub issue #70 for tracking.

Cheers,

Andrei

From: Unbearable [mailto:[email-masked]] On Behalf Of Pranav Kukreja
Sent: Friday, August 19, 2016 3:31 PM
To: [email-masked]
Subject: [Unbearable] RSA padding schemes

  /*

Thanks
Pranav