Subject: Re: [TLS] Using RSA PSS in TLS

From: Peter Gutmann <[email-masked]>
Date: Sun, 18 Jan 2015 03:31:03 +0000

=?windows-1252?Q?Manuel_P=E9gouri=E9-Gonnard?= <[email-masked]> writes:

>Appparently [1] NSS and BoringSSL has been doing that for a few months now
>(though NSS seems to take steps to allow some variation), maybe they could
>provide some feedback?
>
>[1]: https://www.imperialviolet.org/2014/09/26/pkcs1.html

I've been doing this for ages, and I believe OpenSSL does as well(?).  Never
had any problems (or at least none reported) so far...

Peter.

---

From: [email-masked] (Martin Rex)
Date: Thu, 22 Jan 2015 03:06:25 +0100 (CET)

Peter Gutmann wrote:
> <[email-masked]> writes:
> 

Btw. TLSv1.2 explicitly requires support for a slight variation
(NULL and absent parameters) on the TLSv1.2 RSA PKCS#1 v1.5
digitally-signed signature verification, see rfc5246,
section 4.7 3rd paragraph:

  https://tools.ietf.org/html/rfc5246#section-4.7

   In RSA signing, the opaque vector contains the signature generated
   using the RSASSA-PKCS1-v1_5 signature scheme defined in [PKCS1].  As
   discussed in [PKCS1], the DigestInfo MUST be DER-encoded [X680]
   [X690].  For hash algorithms without parameters (which includes
   SHA-1), the DigestInfo.AlgorithmIdentifier.parameters field MUST be
   NULL, but implementations MUST accept both without parameters and
   with NULL parameters.  Note that earlier versions of TLS used a
   different RSA signature scheme that did not include a DigestInfo
   encoding.

-Martin