[Openid-specs-fapi] Question regarding JWS alg in FAPI part 2, read and write security profile

Nat Sakimura nat at sakimura.org
Thu Jul 20 09:48:09 UTC 2017


 

There are a couple of attacks identified by now such as a side-channel
attack[1] and the one uses the implementation errors [2] on the signing
that uses PKCS-v1_5. The attacks being identified and whether it is
practical now is not the same though and I am hoping that it is still
"safe" in practice. One of the problems with the padding is that it is
not proved to be secure while PSS padding is: i.e., there might emerge a
practical attack in a near future. So, it probably is a good idea to
move to PSS if you can. 

[1] http://users.sec.t-labs.tu-berlin.de/~nedos/icisc2011.pdf 

[2]
http://www.intelsecurity.com/resources/wp-berserk-analysis-part-1.pdf 

---
Nat Sakimura
Research Fellow, Nomura Research Institute
Chairman of the Board, OpenID Foundation

On 2017-07-20 18:28, Brian Campbell wrote: 

> I know that there's a general push to move away from RSASSA-PKCS1-v1_5 but is it accurate to say it's unsafe? I see things like this, for example, https://crypto.stackexchange.com/questions/34558/is-ssl-sign-safe-as-it-is-using-openssl-pkcs1-padding [1] 
> 
> On Thu, Jul 20, 2017 at 10:47 AM, Nat Sakimura via Openid-specs-fapi <openid-specs-fapi at lists.openid.net> wrote:
> Hi Sascha,
> 
> This came up during the WG calls as well.
> 
> The short answer is that there are several attacks identified for RSASSA-PKCS1-v1_5 while PSS padding is safe. Cryptographer's opinion is that RSASSA-PKCS1-v1_5 should be retired.
> 
> We agreed in the WG call to add RS256 as a permissible algorithm when HSM is used and the HSM in place does not support PS256 or ES256 in the final but has to be done in the way that it does not raise a red flag from the cryptographers. Please see https://bitbucket.org/openid/fapi/issues/101/jws-signature-algorithms-for-rw [2].
> 
> Best,
> 
> ---
> Nat Sakimura
> Research Fellow, Nomura Research Institute
> Chairman of the Board, OpenID Foundation 
> 
> On 2017-07-20 15:20, Preibisch, Sascha H via Openid-specs-fapi wrote:
> Hi all!
> 
> I just read through the spec. and in section 8.6
> (http://openid.net/specs/openid-financial-api-part-2.html#jws-algorithm-con [3]
> siderations) we recommend to use PS256 or ES256 as signing algorithms.
> 
> Here
> "https://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-14#section [4]
> -3.1" PS256 is marked as OPTIONAL.
> 
> I would like to understand why we recommend PS256 rather than RS256, which
> is RECOMMENDED and widely used.
> 
> I saw that issue #92 spoke about this topic but I did not really
> understood it I believe.
> 
> Thanks,
> Sascha
> 
> _______________________________________________
> Openid-specs-fapi mailing list
> Openid-specs-fapi at lists.openid.net
> http://lists.openid.net/mailman/listinfo/openid-specs-fapi [5] _______________________________________________
> Openid-specs-fapi mailing list
> Openid-specs-fapi at lists.openid.net
> http://lists.openid.net/mailman/listinfo/openid-specs-fapi [5]

_CONFIDENTIALITY NOTICE: This email may contain confidential and
privileged material for the sole use of the intended recipient(s). Any
review, use, distribution or disclosure by others is strictly
prohibited. If you have received this communication in error, please
notify the sender immediately by e-mail and delete the message and any
file attachments from your computer. Thank you._ 

Links:
------
[1]
https://crypto.stackexchange.com/questions/34558/is-ssl-sign-safe-as-it-is-using-openssl-pkcs1-padding
[2]
https://bitbucket.org/openid/fapi/issues/101/jws-signature-algorithms-for-rw
[3]
http://openid.net/specs/openid-financial-api-part-2.html#jws-algorithm-con
[4]
https://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-14#section
[5] http://lists.openid.net/mailman/listinfo/openid-specs-fapi
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openid.net/pipermail/openid-specs-fapi/attachments/20170720/fded300f/attachment.html>


More information about the Openid-specs-fapi mailing list