Subject: [Uta] 7525bis: recommend RSASSA-PSS in TLS 1.2?

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 21 Oct 2021 16:26:09 -0600

In our work on 7525bis, we've identified an issue with RSASSA-PSS, 
specifically whether it should be recommended for TLS 1.2.

Section 4.2.3 of RFC 8446 states:

     The "signature_algorithms_cert" extension was added to allow
     implementations which supported different sets of algorithms for
     certificates and in TLS itself to clearly signal their capabilities.
     TLS 1.2 implementations SHOULD also process this extension.

And, later in the same section, says (non-normatively):

     In TLS 1.2, RSASSA-PSS is used with RSA cipher suites.

This seem to say that support for the extension is RECOMMENDED, but it 
doesn't say that support for RSASSA-PSS itself is RECOMMENDED. 
(Naturally this is for TLS 1.2 - the algorithm is definitively 
RECOMMENDED for TLS 1.3.)

What is the sense of the WG about saying in 7525bis that support for 
RSASSA-PSS should or should not be RECOMMENDED for TLS 1.2?

It's our impression that RSASSA-PSS might help interop in a situation 
like this:

- client can do 1.3 and 1.2
- server can do 1.2
- server has a PSS-OID cert
- server can parse signature_algorithms_cert
- client sends CH with versions = {1.3, 1.2} and 
signature_algorithms_cert = { RSAPSS, ... }
- server accepts 1.2 and sends the PSS-OID cert
- client verifies and session continues happily

Feedback is welcome.

Peter, Thomas, Yaron

---

From: "Martin Thomson" <[email-masked]>
Date: Fri, 22 Oct 2021 11:15:02 +1100

You want to separate the use of PSS in the protocol from PSS in certificates.

Right now, certificates do not routinely include SPKI with PSS OIDs or PSS signatures.  Those are poorly supported.  For example, in Firefox we have most of the necessary support, but our certificate validation library - the last link - is yet to be updated (or it has only very recently been updated; I'd need to check).

Support for PSS in the protocol is different.  However, most TLS 1.2 implementations will have PSS support by virtue of having a TLS 1.3 implementation.  If both client and server support PSS, then there is a good chance that they both support TLS 1.3.  The same logic applies to signature_algorithms_cert (which is also not as widely supported as you might like; NSS doesn't have complete support for that just yet).  Maybe you can see where I'm going ...

On Fri, Oct 22, 2021, at 09:26, Peter Saint-Andre wrote:
> _______________________________________________
> Uta mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/uta

---

From: Peter Gutmann <[email-masked]>
Date: Fri, 22 Oct 2021 11:04:39 +0000

Peter Saint-Andre <[email-masked]> writes:

>What is the sense of the WG about saying in 7525bis that support for RSASSA-
>PSS should or should not be RECOMMENDED for TLS 1.2?

Seems like a really bad idea.  TLS, back to at least SSLv2 25 yeas ago, has
always done PKCS#1v1.5 RSA, not PSS.  I get that TLS 1.3 wants to use PSS, but
it makes no sense to force use in a different protocol that's never used it
throughout its entire existence.

Peter.

---

From: Peter Saint-Andre <[email-masked]>
Date: Fri, 22 Oct 2021 09:59:57 -0600

On 10/21/21 6:15 PM, Martin Thomson wrote:
> Support for PSS in the protocol is different.  However, most TLS 1.2 implementations will have PSS support by virtue of having a TLS 1.3 implementation. 

Well, we've been thinking specifically about whether to recommend PSS 
for TLS 1.2 implementations and deployments. Naturally you get PSS for 
free if you've upgraded to TLS 1.3, but do we want to say that if you 
haven't upgraded to TLS 1.3 yet you should update your TLS 1.2 
implementation or deployment to add PSS?

Peter

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 22 Oct 2021 16:39:30 +0000

No, don't.  It's highly unlike that the TLS 1.2 code will be updated to review and check the extra PSS parameters, so it gives you no additional security.  (It's not clear that many TLS 1.3 implementations do that either)

I find this argument by Peter Gutmann from November 2019 compelling: https://www.metzdowd.com/pipermail/cryptography/2019-November/035449.html

---

From: Peter Saint-Andre <[email-masked]>
Date: Fri, 22 Oct 2021 10:44:53 -0600

On 10/22/21 10:39 AM, Salz, Rich wrote:
> No, don't.  It's highly unlike that the TLS 1.2 code will be updated to review and check the extra PSS parameters, so it gives you no additional security. 

This has been my impression, too, but we want to check with the list.

Peter

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 22 Oct 2021 16:50:05 +0000

>   This has been my impression, too, but we want to check with the list.

OpenSSL has a comment "/* Only allow PSS for TLS 1.3 */" and it looks like the code (tls12_check_peer_sigalg() in ssl/t1_lib.c) enforces that.

---

From: Ilari Liusvaara <[email-masked]>
Date: Fri, 22 Oct 2021 20:34:24 +0300

On Fri, Oct 22, 2021 at 04:50:05PM +0000, Salz, Rich wrote:
> OpenSSL has a comment "/* Only allow PSS for TLS 1.3 */" and it looks
> like the code (tls12_check_peer_sigalg() in ssl/t1_lib.c) enforces
> that.

So if OpenSSL client connects to server that supports PSS but not
TLS 1.3, the connection will fail because the client vomits at the
server response?

-Ilari

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 22 Oct 2021 17:55:41 +0000

I *think* it will fail cleanly because it gets an ALERT message, but I am not sure. I am no longer involved with OpenSSL, I just did a cursory read of the source.

---

From: Ilari Liusvaara <[email-masked]>
Date: Fri, 22 Oct 2021 23:10:21 +0300

On Fri, Oct 22, 2021 at 05:55:41PM +0000, Salz, Rich wrote:
> I *think* it will fail cleanly because it gets an ALERT message, but
> I am not sure. I am no longer involved with OpenSSL, I just did a
> cursory read of the source.

>From reading the code, I think it won't actually fail. It seems that
using TLS 1.3 is the antecedent, and using RSA-PSS is the consequent.
The comment is ambiguous on which is which.

I can not see any way for that code to affect anything for TLS 1.2, but
for TLS 1.3 it definitely seems to make non-PSS RSA signatures fail.

-Ilari