Re: RSA Signature Padding

[Peter Gutmann <pgut001@xxxxxxxxxxxxxxxxx>]

Stefan Santesson <stefan@xxxxxxxxxxx> writes:

>The way I read this is that 1.5 is handcrafted to mitigate known attacks
>while PSS use a more generic and provable secure approach. But neither of
>them are broken.
>
>Would that be a correct assessment?

Yes.  So 1.5 makes some cryptographers uneasy because it's not as rigorous as
PSS, but (barring buggy implementations, which affects PSS as much as 1.5)
there's currently no known attack against it that makes 1.5 worse than PSS.
9796-2, on the other hand, is a long series of patches to fix up weaknesses,
and there's no sign it's getting much better over time.

Peter.