RSA-PSS – Provably secure RSA Signatures and their ...

DNSSEC is a security extension to the domain name system. It was developedback in 1999, but saw no widespread use for quite a long time. In 2008,security researcher Dan Kaminsky presented a real-world attack on the cachingof DNS [US-CERT, 2008]. Through mitigation measures, it was possible tomake such attacks much harder, still DNSSEC is considered the only long-termsolution for a reliable DNS. All domain name authorities are working on implementingDNSSEC and the root zone has been signed in 2010. The latestsignature algorithms based on RSA and SHA-2 are specified in RFC 5702 anduse EMSA-PKCS1-v1 5 (section 3 in [IETF Network Working Group, 2009]).Section 8.1 contains a note that this has been decided to make the transitionfrom the SHA-1 algorithms easier. It is unlikely that this will change, as thecurrent plans of the DNS working group at the IETF are to switch to ellipticcurve algorithms in the future.DKIM (DomainKeys Identified Mail) is a signature system for outgoingemails to prevent spam. Similar to DNSSEC, it was developed long after thestandardization of PSS, but supports exclusively RSA-PKCS1-v1 5, because itsauthors feared it would make implementation too difficult if they required ascheme not widely supported.The Transport Layer Security protocol (formerly SSL) is widely used tosecure existing protocols, like https, pop3s, smtps etc. The latest version doesnot support any padding beside RSASSA-PKCS1-v1 5.As shown in this chapter, a couple of the most significant cryptographicprotocols don’t support RSASSA-PSS at all and there are no transition plans.7.7 Other Protocols using PSSA small number of less widely used protocols implement PSS.Microsoft’s digital rights management system COPP is using RSASSA-PSSsignatures to verify signatures on graphics drivers. However, it uses SHA-1 asa hash algorithm and sets the salt length to zero [Microsoft, 2010].The European standard for smart cards prEN 14890-1:2008 defines an interfacefor RSASSA-PSS based signatures (part 2, page 14, chapter 6.3.2 in[Technical Committee CEN/TC 224, 2008]). It states that the hash for themask generation function and the input have to be the same.7.8 SummaryWe have seen that the support for PSS within cryptographic protocols is verylimited. Many important protocol standards don’t support it at all and fromthe ones that do, implementations are rare.31