Subject: [sidr] rsaEncryption vs sha256WithRSAEncryption in RPKI certificates

From: Alberto Leiva <[email-masked]>
Date: Wed, 22 May 2019 17:18:34 -0500

Hello

Another question.

RFC 7935 states the following:

3.1.  Public Key Format

   (...)

   algorithm (which is an AlgorithmIdentifier type):
      The object identifier for RSA PKCS #1 v1.5 with SHA-256 MUST be
      used in the algorithm field, as specified in Section 5 of
      [RFC4055].  The value for the associated parameters from that
      clause MUST also be used for the parameters field.

I've never seen a certificate that declares sha256WithRSAEncryption ({
pkcs-1 11 }) as its public key algorithm. Every certificate I've come
across labels its algorithm as rsaEncryption ({ pkcs-1 1 }).

(Certificates always define the signature algorithm as
sha256WithRSAEncryption, but that's a different field.)

Is everyone doing it wrong, or am I missing something?

I'm aware that this is likely a triviality--rsaEncryption and
sha256WithRSAEncryption probably mean the same in this context.
There's also a thread in this list in which people seem to have
experienced headaches over this topic. But the thread is talking about
CMS signed objects (which I believe is different from certificates),
and happened before 7935 was released, so it feels like the RFC should
mandate something consistent with reality by now.

Thanks for any pointers.

---

From: Martin Hoffmann <[email-masked]>
Date: Thu, 23 May 2019 11:23:09 +0200

> across labels its algorithm as rsaEncryption ({ pkcs-1 1 }).

I’ve been struggling with this, too. My conclusion was that RFC 7935 is
misleading at best. Section 5 of RFC 4055 talks about signature
algorithms not public key algorithms. Section 1.2 of RFC 4055 states

|   The rsaEncryption object identifier continues to identify the subject
|   public key when the RSA private key owner does not wish to limit the
|   use of the public key exclusively to either RSASSA-PSS or RSAES-OAEP.
|   In this case, the rsaEncryption object identifier MUST be used in the
|   algorithm field within the subject public key information, and the
|   parameters field MUST contain NULL.

So, for RSA v1.5, the key algorithm must be rsaEncryption. Routinator
does indeed require that. It doesn’t insist on the presence of the NULL,
though, and allows absent parameters.

The certificates we are generating in Krill will all have rsaEncryption
as the algorithm and the NULL paramteres field.

Kind regards,
Martin

---

From: Russ Housley <[email-masked]>
Date: Thu, 23 May 2019 12:23:03 -0400

> On May 22, 2019, at 6:18 PM, Alberto Leiva <[email-masked]> wrote:
> 
> Hello
> 
> Another question.
> 

You are right.

In the subjectPublicKeyInfo, the algorithm identifier should be rsaEncryption, which is { 1, 2, 840, 113549, 1, 1, 1 }.  This allow the public key to be used with PKCS#1 v1.5, RSASSA-PSS, and RSAES-OAEP.

In the signature, the algorithm identifier should be sha256WithRSAEncryption, which is { 1, 2, 840, 113549, 1, 1, 11 }.  This identifies PKCS#1 v1.5 with SHA-256 as the hash algorithm.

Russ

---

From: Alberto Leiva <[email-masked]>
Date: Thu, 23 May 2019 13:16:53 -0500

I see. Is this erratum-worthy?

---

From: Alberto Leiva <[email-masked]>
Date: Thu, 23 May 2019 16:10:35 -0500

> Routinator

Lol. So you struggled with absent vs NULL parameters too?
I wondered whether I should have included that too in this query.