yuzu-emu/mbedtls
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Fix discussion of RSA-PSS salt length

Browse source 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
This commit is contained in:
Manuel Pégourié-Gonnard 2022-02-07 10:19:08 +01:00
parent 2467aed961
commit 539b9a52f9
1 changed files with 8 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
docs/architecture/psa-migration/psa-limitations.md
View file

@ -118,11 +118,15 @@ algorithms can differ from each other.
- PSA: - PSA:
- algorithm specification: - algorithm specification:
- hash alg used for message hashing, encoding and MGF1 - hash alg used for message hashing, encoding and MGF1
- salt length can be either "standard" (== hashlen) or "any" - salt length can be either "standard" (<= hashlen, see note) or "any"
- signature generation: - signature generation:
- salt length: always using the maximum legal value and random salt - salt length: always <= hashlen (see note) and random salt
- verification: - verification:
- salt length: either == hashlen, or any depending on algorithm - salt length: either <= hashlen (see note), or any depending on algorithm
Note: above, "<= hashlen" means that hashlen is used if possible, but if it
doesn't fit because the key is too short, then the maximum lenght that fits is
used.
The RSA/PK API is in principle more flexible than the PSA Crypto API. The The RSA/PK API is in principle more flexible than the PSA Crypto API. The
following sub-sections study whether and how this matters in practice. following sub-sections study whether and how this matters in practice.
@ -158,7 +162,7 @@ match a limitation of the PSA API.
It is unclear what parameters people use in practice. It looks like by default It is unclear what parameters people use in practice. It looks like by default
OpenSSL picks saltlen = keylen - hashlen - 2 (tested with openssl 1.1.1f). OpenSSL picks saltlen = keylen - hashlen - 2 (tested with openssl 1.1.1f).
The `certool` command provided by GnuTLS seems to be picking saltlen = hashlen The `certool` command provided by GnuTLS seems to be picking saltlen = hashlen
by default (tested with GnuTLS 3.6.13). FIPS 186-4 recommends saltlen >= by default (tested with GnuTLS 3.6.13). FIPS 186-4 recommends 0 <= saltlen <=
hashlen. hashlen.
### Use in TLS ### Use in TLS