Subject: [saag] RSA-PSS

From: Russ Housley <[email-masked]>
Date: Wed, 4 Dec 2013 06:04:57 -0500

We have known for a very long time that PKCS #1 Version 1.5 (see RFC 2313) signature is more fragile than we might like.  PKCS #1 Version 1.5 signatures were developed in an ad hoc manner; RSASSA-PSS as specified in PKCS #1 Version 2.1 (see RFC 3447) was developed based on mathematical foundations.

I am aware of two attacks against PKCS #1 Version 1.5 implementations:

First, the Bleichenbacher attack against implementations.  In this attack, implementations do not calculate the length of the padding, but rather scan the 0xff at the beginning until they find a 0x00 byte.  Also, a small RSA exponent (for example e=3).

Second, fault-based attacks described by Boneh and others.  By injecting random faults into the RSA calculations, the attacker is able to regenerate the private key from the knowledge of faulty signatures.

RSA-PSS offers significant improvement against both of these attacks.

We have seen very little movement toward RSA-PSS.  While we are reviewing algorithm choices in light of the pervasive surveillance situation, I think we should take the time to consider improvements in our algorithm choices.

Russ

---

From: Tero Kivinen <[email-masked]>
Date: Thu, 5 Dec 2013 13:16:00 +0200

Russ Housley writes:
> We have seen very little movement toward RSA-PSS.  While we are
> reviewing algorithm choices in light of the pervasive surveillance
> situation, I think we should take the time to consider improvements
> in our algorithm choices. 

In the IPsecME WG we have draft-kivinen-ipsecme-signature-auth
document which allows also using the RSASSA-PSS in addition to the
RSASSA-PKCS1-v1_5 in the IKEv2. Unfortunately I have not received that
many reviews on the document, especially for the RSASSA-PSS parts.

The RSASSA-PSS is quite a lot more complex than RSASSA-PKCS1-v1_5,
especially with all the ASN.1 in the parameters etc, and I am not sure
if the text I have written about it is correct. It would be useful if
someone who is really familiar with RSASSA-PSS would review the
draft...
-- 
[email-masked]