- From: Anders Rundgren <anders.rundgren@telia.com>
- Date: Fri, 17 Aug 2012 06:40:59 +0200
- To: "public-webcrypto-comments@w3.org" <public-webcrypto-comments@w3.org>
It seems from the list of algorithms that the signature method used by 99.99% of all existing applications has been deprecated since it is not listed. It doesn't get less puzzling when W3C's latest XML Signature draft http://www.w3.org/TR/xmldsig-core2 <http://www.w3.org/TR/xmldsig-core2/> list PKCS 1.5 signatures as REQUIRED and doesn't even mention the RSA-PSS algorithm as OPTIONAL! No, I'm not a cryptographer but AFAIK nobody has cracked PKCS 1.5 signatures in the way that has happened with PKCS 1.5 encryption and recently with AES-CBC. Feel free RECOMMEND whatever the "crypto-skeptical-community" thinks is OK, but ignoring the de-facto standard is probably not a great idea. Anders
Received on Friday, 17 August 2012 04:41:32 UTC