RSA-PSS – Provably secure RSA Signatures and their ...

8.10 DifficultiesI found out that the most difficult part was not the implementation of the PSSpadding itself, but the handling of the parameter block. RFC 3447 specifiesa parameter block (s. 49 in [RSA Inc., 2002]) allowing to specify the hashfunction, salt length, mask generation function and the hash function used insidethe mask generation function. The parameters are decoded (cryptohi/secvfy.c)several API layers above the signature generation (softoken/rsawrapr.c) andhave to be passed through them (pk11wrap/pk11obj.c). None of the existingalgorithms within nss had a parameter block, so this required a bunch of APIchanges.8.11 Conclusions from the ImplementationThe parameter block adds a lot of complexity for no real gain. It allows forexample constructions where the hash function used directly and the hash functionfor the mask generation function differ (e.g., SHA-1 with MGF1 usingSHA-256). The variable salt length allows to choose values that violate thesecurity properties of the whole PSS construction (e.g., a zero length salt). Itwould’ve been much easier to stick to a predefined set of sane parameters andassign them their own IDs.Another point where unnecessary complexity was added was the handlingof key sizes. A number of bit-shifting operations were only necessary becauseRFC 3447 allows keys of any size. It would have made the whole implementationsignificantly simpler if the allowed key sizes were restricted to ones divisible by8 (which makes a byte-representation without padding possible). As usuallyall real-world applications use common key sizes like 1024, 2048 or 4096, thisrestriction would not have many implications on users.The fact that the only input to the whole signature generation and verificationfunctions is the hash of a message was welcome for the implementation,but it weakens the security (see chapter 5). It would’ve needed even more APIchanges to make a construction like the original PSS proposal that does notstart with Hash(M) possible. However, I would still consider randomizationof the hash a good idea, as it would vastly improve the security on real-worldattacks.8.12 SummaryI have provided working patches to support RSASSA-PSS in nss, a cryptographiclibrary widely used by popular products like the Mozilla Firefox browser.Due to the very invasive changes required, inclusion of them into the main nsscodebase will probably still require some time.Further possible tasks that could be done are support for designatedRSASSA-PSS keys/certificates and support for Cryptographic Message Syntax37