<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>Thank you all for your responses!</div>
<div><br>
</div>
<div>I am getting a better understanding now as I am also doing some reading up on it.</div>
<div><br>
</div>
<div>Regards,</div>
<div>Sascha</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Openid-specs-fapi <<a href="mailto:openid-specs-fapi-bounces@lists.openid.net">openid-specs-fapi-bounces@lists.openid.net</a>> on behalf of Nat Sakimura via Openid-specs-fapi <<a href="mailto:openid-specs-fapi@lists.openid.net">openid-specs-fapi@lists.openid.net</a>><br>
<span style="font-weight:bold">Reply-To: </span>Nat Sakimura <<a href="mailto:nat@sakimura.org">nat@sakimura.org</a>>, Financial API Working Group List <<a href="mailto:openid-specs-fapi@lists.openid.net">openid-specs-fapi@lists.openid.net</a>><br>
<span style="font-weight:bold">Date: </span>Thursday, July 20, 2017 at 2:48 AM<br>
<span style="font-weight:bold">To: </span>Brian Campbell <<a href="mailto:bcampbell@pingidentity.com">bcampbell@pingidentity.com</a>><br>
<span style="font-weight:bold">Cc: </span>Financial API Working Group List <<a href="mailto:openid-specs-fapi@lists.openid.net">openid-specs-fapi@lists.openid.net</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Openid-specs-fapi] Question regarding JWS alg in FAPI part 2, read and write security profile<br>
</div>
<div><br>
</div>
<div>
<div style="font-family: Verdana,Geneva,sans-serif"><i>CAUTION: This email originated from outside of CA. Do not click links or open attachments unless you recognize the sender and know the content is safe.</i><br>
<br>
<div>
<p>There are a couple of attacks identified by now such as a side-channel attack[1] and the one uses the implementation errors [2] on the signing that uses PKCS-v1_5. The attacks being identified and whether it is practical now is not the same though and I
am hoping that it is still "safe" in practice. One of the problems with the padding is that it is not proved to be secure while PSS padding is: i.e., there might emerge a practical attack in a near future. So, it probably is a good idea to move to PSS if you
can. </p>
<p>[1] <a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__users.sec.t-2Dlabs.tu-2Dberlin.de_-7Enedos_icisc2011.pdf&d=DwQFaQ&c=_hRq4mqlUmqpqlyQ5hkoDXIVh6I6pxfkkNxQuL0p-Z0&r=BjnOFeRZMwPBZLm00SguJm4i4lt0O13oAeF-9EZheL8&m=gEf-X7S2whQR5kfm_Ao4ZIXKA_itJcoFNgBzRwLqCfk&s=bEZRr2Ly7D-qU7zhzs_CQ8x7RH6-SBgh3oYnJ4JHgKI&e=">http://users.sec.t-labs.tu-berlin.de/~nedos/icisc2011.pdf</a></p>
<p>[2] <a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__www.intelsecurity.com_resources_wp-2Dberserk-2Danalysis-2Dpart-2D1.pdf&d=DwQFaQ&c=_hRq4mqlUmqpqlyQ5hkoDXIVh6I6pxfkkNxQuL0p-Z0&r=BjnOFeRZMwPBZLm00SguJm4i4lt0O13oAeF-9EZheL8&m=gEf-X7S2whQR5kfm_Ao4ZIXKA_itJcoFNgBzRwLqCfk&s=cSDAkw-COvSsbaylVftzCTGXPWNg6r1gksVHBJ816qg&e=">http://www.intelsecurity.com/resources/wp-berserk-analysis-part-1.pdf</a></p>
<div>
<pre>---<br>Nat Sakimura
Research Fellow, Nomura Research Institute
Chairman of the Board, OpenID Foundation</pre>
</div>
<p>On 2017-07-20 18:28, Brian Campbell wrote:</p>
<blockquote type="cite" style="padding-left:5px; border-left:#1010ff 2px solid; margin-left:5px">
<!-- html ignored --><!-- head ignored --><!-- meta ignored -->
<div dir="ltr">I know that there's a general push to move away from RSASSA-PKCS1-v1_5 but is it accurate to say it's unsafe? I see things like this, for example,
<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__crypto.stackexchange.com_questions_34558_is-2Dssl-2Dsign-2Dsafe-2Das-2Dit-2Dis-2Dusing-2Dopenssl-2Dpkcs1-2Dpadding&d=DwMFaQ&c=_hRq4mqlUmqpqlyQ5hkoDXIVh6I6pxfkkNxQuL0p-Z0&r=BjnOFeRZMwPBZLm00SguJm4i4lt0O13oAeF-9EZheL8&m=gEf-X7S2whQR5kfm_Ao4ZIXKA_itJcoFNgBzRwLqCfk&s=a9FWAOUCfMbufPWpNi7AR9NuSpsMGYXyWbuc6aBl0IM&e=">
https://crypto.stackexchange.com/questions/34558/is-ssl-sign-safe-as-it-is-using-openssl-pkcs1-padding</a></div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Thu, Jul 20, 2017 at 10:47 AM, Nat Sakimura via Openid-specs-fapi
<span><<a href="mailto:openid-specs-fapi@lists.openid.net">openid-specs-fapi@lists.openid.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin: 0 0 0 .8ex; border-left: 1px #ccc solid; padding-left: 1ex;">
Hi Sascha,<br>
<br>
This came up during the WG calls as well.<br>
<br>
The short answer is that there are several attacks identified for RSASSA-PKCS1-v1_5 while PSS padding is safe. Cryptographer's opinion is that RSASSA-PKCS1-v1_5 should be retired.<br>
<br>
We agreed in the WG call to add RS256 as a permissible algorithm when HSM is used and the HSM in place does not support PS256 or ES256 in the final but has to be done in the way that it does not raise a red flag from the cryptographers. Please see
<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__bitbucket.org_openid_fapi_issues_101_jws-2Dsignature-2Dalgorithms-2Dfor-2Drw&d=DwMFaQ&c=_hRq4mqlUmqpqlyQ5hkoDXIVh6I6pxfkkNxQuL0p-Z0&r=BjnOFeRZMwPBZLm00SguJm4i4lt0O13oAeF-9EZheL8&m=gEf-X7S2whQR5kfm_Ao4ZIXKA_itJcoFNgBzRwLqCfk&s=WvnHCYfQRfCcRK_6K12ozLENJwDM8nKm6z-Uvdx_fyA&e=">
https://bitbucket.org/openid/fapi/issues/101/jws-signature-algorithms-for-rw</a>.<br>
<br>
Best,<br>
<br>
---<br>
Nat Sakimura<br>
Research Fellow, Nomura Research Institute<br>
Chairman of the Board, OpenID Foundation
<div class="HOEnZb">
<div class="h5"><br>
<br>
On 2017-07-20 15:20, Preibisch, Sascha H via Openid-specs-fapi wrote:<br>
<blockquote class="gmail_quote" style="margin: 0 0 0 .8ex; border-left: 1px #ccc solid; padding-left: 1ex;">
Hi all!<br>
<br>
I just read through the spec. and in section 8.6<br>
(<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__openid.net_specs_openid-2Dfinancial-2Dapi-2Dpart-2D2.html-23jws-2Dalgorithm-2Dcon&d=DwMFaQ&c=_hRq4mqlUmqpqlyQ5hkoDXIVh6I6pxfkkNxQuL0p-Z0&r=BjnOFeRZMwPBZLm00SguJm4i4lt0O13oAeF-9EZheL8&m=gEf-X7S2whQR5kfm_Ao4ZIXKA_itJcoFNgBzRwLqCfk&s=I-scfSiCcmeFa8ZMPHUw24XvL8hI0wjLbMBn-bbZP_s&e=">http://openid.net/specs/openid-financial-api-part-2.html#jws-algorithm-con</a><br>
siderations) we recommend to use PS256 or ES256 as signing algorithms.<br>
<br>
Here<br>
"<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__tools.ietf.org_html_draft-2Dietf-2Djose-2Djson-2Dweb-2Dalgorithms-2D14-23section&d=DwMFaQ&c=_hRq4mqlUmqpqlyQ5hkoDXIVh6I6pxfkkNxQuL0p-Z0&r=BjnOFeRZMwPBZLm00SguJm4i4lt0O13oAeF-9EZheL8&m=gEf-X7S2whQR5kfm_Ao4ZIXKA_itJcoFNgBzRwLqCfk&s=5vAR01BAdqS253Tf16CWhFn8JHOt_vz4qql_KfDp72k&e=">https://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-14#section</a><br>
-3.1" PS256 is marked as OPTIONAL.<br>
<br>
I would like to understand why we recommend PS256 rather than RS256, which<br>
is RECOMMENDED and widely used.<br>
<br>
I saw that issue #92 spoke about this topic but I did not really<br>
understood it I believe.<br>
<br>
<br>
Thanks,<br>
Sascha<br>
<br>
<br>
_______________________________________________<br>
Openid-specs-fapi mailing list<br>
<a href="mailto:Openid-specs-fapi@lists.openid.net">Openid-specs-fapi@lists.openid.net</a><br>
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_mailman_listinfo_openid-2Dspecs-2Dfapi&d=DwMFaQ&c=_hRq4mqlUmqpqlyQ5hkoDXIVh6I6pxfkkNxQuL0p-Z0&r=BjnOFeRZMwPBZLm00SguJm4i4lt0O13oAeF-9EZheL8&m=gEf-X7S2whQR5kfm_Ao4ZIXKA_itJcoFNgBzRwLqCfk&s=JXIITqVXu2MXqBK7x-AL89E8vLb5nwP8uJ5pK52iV28&e=">http://lists.openid.net/mailman/listinfo/openid-specs-fapi</a></blockquote>
_______________________________________________<br>
Openid-specs-fapi mailing list<br>
<a href="mailto:Openid-specs-fapi@lists.openid.net">Openid-specs-fapi@lists.openid.net</a><br>
<a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.openid.net_mailman_listinfo_openid-2Dspecs-2Dfapi&d=DwMFaQ&c=_hRq4mqlUmqpqlyQ5hkoDXIVh6I6pxfkkNxQuL0p-Z0&r=BjnOFeRZMwPBZLm00SguJm4i4lt0O13oAeF-9EZheL8&m=gEf-X7S2whQR5kfm_Ao4ZIXKA_itJcoFNgBzRwLqCfk&s=JXIITqVXu2MXqBK7x-AL89E8vLb5nwP8uJ5pK52iV28&e=">http://lists.openid.net/mailman/listinfo/openid-specs-fapi</a></div>
</div>
</blockquote>
</div>
</div>
<br>
<em style="margin: 0px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background: #ffffff; font-family: proxima-nova-zendesk,system-ui,-apple-system,system-ui,'Segoe UI',Roboto,Oxygen-Sans,Ubuntu,Cantarell,'Helvetica Neue',Arial,sans-serif; color: #555555;"><span style="margin: 0px; padding: 0px; border: 0px; outline: 0px; vertical-align: baseline; background: transparent; font-family: proxima-nova-zendesk,system-ui,-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Oxygen-Sans,Ubuntu,Cantarell,'Helvetica Neue',Arial,sans-serif; font-weight: 600;"><span style="font-size: small;">CONFIDENTIALITY
NOTICE: This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by others is strictly prohibited. If you have received this communication in error, please notify
the sender immediately by e-mail and delete the message and any file attachments from your computer. Thank you.</span></span></em></blockquote>
</div>
</div>
</div>
</span>
</body>
</html>