RE: Can the RSA PSS salt length be changed?

Hi Petr,

B.7 follows you quoted sentence with=20
NOTE If the TPM implementation is required to be compliant with FIPS 186-4,=
 then the random salt length will be the largest size allowed by that speci=
fication.

So basically, the TPM has now way of setting it, but uses either the max le=
ngth or the hash-size length (up to the vendor).
This was introduced after we found the incompatibilities as you mentioned.

By now, I would assume that implementations have switched to the hash-size =
based salt length following FIPS 186-4, but the only way to know is to chec=
k databooks or test.

Bests,
Andreas

-----Original Message-----
From: Petr Gotthard <[email protected]>=20
Sent: Samstag, 29. Juni 2024 12:04
To: [email protected]
Subject: Can the RSA PSS salt length be changed?

Caution: This e-mail originated outside Infineon Technologies. Please be ca=
utious when sharing information or opening attachments especially from unkn=
own senders. Refer to our intranet guide<https://intranet-content.infineon.=
com/explore/aboutinfineon/rules/informationsecurity/ug/SocialEngineering/Pa=
ges/SocialEngineeringElements_en.aspx> to help you identify Phishing email.



Hello,
I have a question concerning the TCG specification.

OpenSSL has a function EVP_PKEY_CTX_set_rsa_pss_saltlen() that be used to s=
et the RSA PSS salt length. Some implementations don't use the maximum poss=
ible salt length, but use a shorter value, e.g. set the salt length to the =
digest length (RSA_PSS_SALTLEN_DIGEST).
https://www.openssl.org/docs/manmaster/man3/EVP_PKEY_CTX_set_rsa_pss_saltle=
n.html

The TCG specification (Part 1, Section B.7) on the other hand says: For bot=
h restricted and unrestricted signing keys, the random salt length will be =
the largest size allowed by the key size and message digest size.

Does this mean that a TPM2.0 cannot handle shorter RSA PSS salt lengths, i.=
e. that the EVP_PKEY_CTX_set_rsa_pss_saltlen() function can never be implem=
ented using any TPM? This might cause compatibility issues.


Regards,
Petr