Dear openssl developers,
we are about to setup a new pki. So we have to choose the appropriate
algorithms and parameters.
How about certificates signed using rsa pcks#1v2.1 (aka pss) signed
certificates?
The latest known statement in this context we found is from Dr. Henson
on May 8, 2014.
He stated:
...
It is possible to add an "alias" for this algorithm and then OpenSSL can
handle the key directly. It wont however support the PSS semantics properly:
i.e. the key can only be used for PSS and any parameter restrictions. For that
reason this hasn't been done in the official sources.
...
Is there any progress in adopting pss certificates consistently? Which
difficulies do exist?
The current German Algorithmenkatalog states, that security fitness for
signatures using the
rsa pkcs#1v1.5 padding ends at the end of 2016. Therefore, we are
looking for proper algorithms
whose security finess ist expected to last longer.
Currently the only named alternative is ecdsa signatures, which should
be thoroughly supported
by current openssl versions.
Thanks in advance
--
Christian Weber
_______________________________________________
openssl-dev mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-dev
