<!-- This file has been automatically generated. See web/README.md -->
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body>
<div id="compose-container" style="direction: ltr" itemscope="" itemtype="https://schema.org/EmailMessage">
<span itemprop="creator" itemscope="" itemtype="https://schema.org/Organization"><span itemprop="name" content="Outlook Mobile for iOS"></span></span>
<div>
<div style="direction: ltr;">Hello,<br>
</div>
<div class="gmail_quote">
<div id="compose-container" style="direction: ltr">
<div style="direction: ltr;"><br>
</div>
<div style="direction: ltr;">Are there any plans to support RSA PSS as a Signature algorithm? </div>
<div style="direction: ltr;"><a dir="ltr" href="https://bugs.openjdk.java.net/browse/JDK-8146293">https://bugs.openjdk.java.net/browse/JDK-8146293</a></div>
<div style="direction: ltr;"><br>
</div>
<div style="direction: ltr;">In the german energy market RSA PSS is used for signing messages, and authorities demand to use it also for certificate signatures (RFC 4055) starting with 2018. This is somewhat paranoid but hey, it's a field requirement.</div>
<div style="direction: ltr;"><br>
</div>
<div style="direction: ltr;">At the moment BouncyCastle can be used as a Signature provider and if also used to create X509Certificate objects it can even verify the Signature.</div>
<div style="direction: ltr;"><br>
</div>
<div style="direction: ltr;">BTW: when the BC provider is registered the JDK X509Certificate.verify() finds the RSA PSS OID and uses the BC implementation, however the verification fails for non-Standard parameters (which is not uncommon since people try to
avoid SHA1 in MFG1j as it does not parse and set the aproperiate parameters.</div>
<div style="direction: ltr;"><br>
</div>
<div style="direction: ltr;">I wonder if the modularity of X509Certificate could be enhanced to allow that? Having an option to extract ParameterSpec from a random signature block would certainly be a nice feature (similar to looking up the algorithm itself
by OID)</div>
<div style="direction: ltr;"><br>
</div>
<div style="direction: ltr;">BTW there was some discussion on PKCS#11 supporting it - I think the Athena PKCS11 lib with their JCOS based IDProtect tokens supports RSAPSS as an mechanism.</div>
<div style="direction: ltr;"><br>
</div>
<div style="direction: ltr;">But I guess that are three different topic, JCE Signature, X509CertExtension and PKCS11 mechanism.</div>
<div style="direction: ltr;"><br>
</div>
<div class="acompli_signature">Gruss<br>
Bernd<br>
-- <br>
<a dir="ltr" href="http://bernd.eckenfels.net" x-apple-data-detectors="true" x-apple-data-detectors-type="link" x-apple-data-detectors-result="4">http://bernd.eckenfels.net</a></div>
</div>
<br>
<br>
</div>
</div>
</div>
</body>
</html>