search

MikeBishop / http2-certs

Enabling client certificate authentication in HTTP/2
3 stars 2 forks source link

RSA-PSS versus RSA-PSS #6

Open MikeBishop opened 8 years ago

MikeBishop commented 8 years ago

From Andrei:

nearly all available certs today use RSA-PKCS1.5 rather than RSA-PSS. Are you relying on all sites and clients getting new certs to support this?

The bitmap is about the signatures which we support in the PROOF frame, not about how the certificates themselves are signed. Now, whether existing RSA certs can generate RSA-PSS signatures is a question for Crypto folks – I would think that an RSA key can be used for multiple signing schemes, but I could also be wrong. Issue to track confirming.

martinthomson commented 8 years ago

For TLS, we decided to allow PKCS#1.5. That was reluctant. Here, we can limit the choice safely, I think. Those people that have to spend extra cycles, or who can't do PSS can fall back to less optimized paths (i.e., multiple connections).

MikeBishop commented 8 years ago

I agree on the safety of the constraint. Where I'm out of my depth is whether PSS needs a different cert or just a different signature algorithm with the same cert.

martinthomson commented 8 years ago

So there is a different OID for the two algorithms, but ultimately it's just an RSA key, so it can be used with either if you are willing to do so. I believe that this is the intent with PSS in TLS 1.3.