RSA-PSS – Provably secure RSA Signatures and their ...

and physics where today very little is known at all. So while what would berequired for “provable security” is in theory imaginable, it is unlikely to happenany time soon.12 Conclusion12.1 Difficulties in deploying better CryptographyIn theory, we’d like to see the best cryptography that is available used withinreal world applications. In practice, this is often not the case – often enough,what’s used is just “what’s not completely broken yet” and widespread adoptionwaits until real-world attacks can be shown in practice.We saw that the PSS padding provides better security in certain circumstancesthan old padding methods like PKCS #1 v1.5. However, adoption ofRSA-PSS is widely lacking. What we can see here and also with similar examples(like the transition from MD5/SHA-1 to SHA-2) is that it seems to bevery hard to deploy improvements from theoretical cryptographic research topractical applications.For an algorithm to be used, it usually has to pass several obstacles:1. The algorithm has to be developed, examined and accepted by the cryptographiccommunity.2. The algorithm primitives have to be standardized.3. High level protocols using those primitives need to be standardized.4. The standards need to be implemented in libraries and applications, boththe primitives and the high level protocols.5. Finally, they need to be used and set as the default within applications.RSASSA-PSS is mostly stuck between 2 and 3. But even when looking atthe example of SHA-2, it is in many cases stuck between 3 and 4, althoughreal-world attacks are expected within the next couple of years.One of the most often cited reasons not to switch to better algorithms isbackwards compatibility. As an extreme example, within the browser marked,it usually can be expected that rarely anyone will adopt anything that is notbackwards compatible to browsers several years old (the argument I hear mostoften when asking for signatures using SHA-2 instead of SHA-1 is that WindowsXP before SP3 does not support that). So even if at some point all browserssupport X.509 certificates with RSASSA-PSS, it is unlikely that any majorcertificate authority will use them any time soon.But that does not explain why it also seems to be very hard to deployimprovements on the standards level. As we have seen, PSS has not been47