<html>
<head>
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-15">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><font face="Calibri">Anybody knows of a public server using an
SSL certificate signed with RSA-PSS ?</font></p>
<p>Adriano</p>
<p><br>
</p>
<div class="moz-cite-prefix">Il 01/03/2016 21:49, Peter Bowen ha
scritto:<br>
</div>
<blockquote type="cite"
cite="mid:%3C6D467423-801D-4B21-B4C0-C6CBDAB47D0B@amzn.com%3E">
<pre class="moz-quote-pre" wrap="">Rick,
One clarification related specifically to CA/Browser Forum:
I do not see anything in the BRs that requires or forbids RSASSA-PSS. Is there anything that prevents public CAs from issuing certificates with RSASSA-PSS (e.g RFC 4055/5756) signatures?
Thanks,
Peter
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">On Mar 1, 2016, at 12:12 PM, Rick Andrews <a class="moz-txt-link-rfc2396E" href="mailto:rick_andrews@symantec.com"><rick_andrews@symantec.com></a> wrote:
I'm cross-posting in case others want to participate in this discussion on
the IETF TLS Working Group. They're having a debate on whether TLS 1.3
should allow or require RSA-PSS signatures on TLS certificates.
It would be better to have the debate there instead of here, but I will
cross-post if anyone has a burning need to share but not join the WG.
-Rick
----------------------------------------------------------------------
Message: 1
Date: Tue, 1 Mar 2016 21:20:39 +0200
From: Yoav Nir <a class="moz-txt-link-rfc2396E" href="mailto:ynir.ietf@gmail.com"><ynir.ietf@gmail.com></a>
To: Alyssa Rowan <a class="moz-txt-link-rfc2396E" href="mailto:akr@akr.io"><akr@akr.io></a>
Cc: <a class="moz-txt-link-abbreviated" href="mailto:tls@ietf.org">tls@ietf.org</a>
Subject: Re: [TLS] RSA-PSS in TLS 1.3
Message-ID: <a class="moz-txt-link-rfc2396E" href="mailto:BBA8149E-114A-49D3-8159-A87ADB545482@gmail.com"><BBA8149E-114A-49D3-8159-A87ADB545482@gmail.com></a>
Content-Type: text/plain; charset=utf-8
On 1 Mar 2016, at 8:23 PM, Alyssa Rowan <a class="moz-txt-link-rfc2396E" href="mailto:akr@akr.io"><akr@akr.io></a> wrote:
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">[YN] It would be cool to ban PKCS#1.5 from certificates, but we are
not the PKIX working group. Nor are we the CA/Browser forum.
When a CA issues a certificate it has to work with every client and
server out there, When we use TLS 1.3, the other side supports TLS
1.3 as well, so it?s fair to assume that it knows PSS.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Perhaps the PKIX working group and CAB/Forum could both use a friendly
reminder not to ignore how perilous using RSA PKCS#1 v1.5 still remains?
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Neither you nor I can post in any of the CA/Browser forum?s lists, because
neither of us has either a browser or a public CA.
There are some people who are active there and are reading this list, so
they might take such a proposal there. I?m not very optimistic, though.
While only CAs and browsers are members, they are keenly aware that even the
public CAs have a wide variety of relying parties, running all sorts of
software. And it?s much harder to scan clients than it is to scan servers,
so it?s difficult to say how many clients will not be able to connect to a
server with a certificate signed with RSA-PSS. Probably far too many for the
CA/BF to be comfortable deprecating PKCS#1.
The PKIX working group has shut down several years ago. The Curdle WG is a
new working group whose charter includes deprecating obsolete stuff. Perhaps
they might be interested.
Yoav
_______________________________________________
Public mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Public@cabforum.org">Public@cabforum.org</a>
<a class="moz-txt-link-freetext" href="https://cabforum.org/mailman/listinfo/public">https://cabforum.org/mailman/listinfo/public</a>
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
_______________________________________________
Public mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Public@cabforum.org">Public@cabforum.org</a>
<a class="moz-txt-link-freetext" href="https://cabforum.org/mailman/listinfo/public">https://cabforum.org/mailman/listinfo/public</a>
</pre>
</blockquote>
</body>
</html>