Subject: [Cfrg] Question about RSA keys

From: Yoav Nir <[email-masked]>
Date: Sat, 19 Nov 2016 10:48:18 +0200

Hi

An issue has come up while reviewing the TLS 1.3 draft.  TLS 1.2 supports only PKCS#1 signatures. TLS 1.3 has only RSA-PSS signatures. Progress!

However, most servers (and clients) in the foreseeable future are going to support both TLS 1.2 and TLS 1.3, and they’re going to do this with a single certificate that might have an RSA key.

So my question is, is there a problem with having the server (or client) signing some TLS transcripts with PKCS#1 and others with RSA-PSS? 

Thanks

Yoav

---

From: Hanno Böck <[email-masked]>
Date: Sat, 19 Nov 2016 10:06:59 +0100

On Sat, 19 Nov 2016 10:48:18 +0200
Yoav Nir <[email-masked]> wrote:

> However, most servers (and clients) in the foreseeable future are
> going to support both TLS 1.2 and TLS 1.3, and they’re going to do
> this with a single certificate that might have an RSA key.
> 
> So my question is, is there a problem with having the server (or
> client) signing some TLS transcripts with PKCS#1 and others with
> RSA-PSS? 

This came up before. Ideally you'd want key separation, but this is
complicated. There are to my knowledge no known attacks that exploit
the combination of PKCS #1 1.5 and PSS.

However we've been using the same keys for PKCS #1 1.5 encryption and
signatures for ages and this is most likely more concerning, see [1]
and DROWN [2].
I think the theoretical concerns about mixing PKCS #1 1.5 and PSS
with the same key are minor compared to the issues raised by combining
encryption and signatures with the same key.

[1] http://euklid.org/pdf/CCS15.pdf
[2] https://drownattack.com/drown-attack-paper.pdf

-- 
Hanno Böck
https://hboeck.de/

mail/jabber: [email-masked]
GPG: FE73757FA60E4E21B937579FA5880072BBB51E42

---

From: Yoav Nir <[email-masked]>
Date: Sat, 19 Nov 2016 14:45:06 +0200

> On 19 Nov 2016, at 11:06, Hanno Böck <[email-masked]> wrote:
> 

Thanks, that’s what I thought I remembered.

> encryption and signatures with the same key.

Yes, and RSA decryption can be avoided even in TLS 1.2 and earlier with a proper selection of ciphersuites.

Yoav