more PKCS removal cleanup

Author: mxsasha

checks/scoring.py

@@ -196,11 +196,6 @@
 WEB_TLS_OCSP_STAPLING_BAD = NO_POINTS
 WEB_TLS_OCSP_STAPLING_WORST_STATUS = STATUS_NOTICE
 
-TLS_KEX_RSA_PKCS_GOOD = FULL_WEIGHT_POINTS
-TLS_KEX_RSA_PKCS_OK = FULL_WEIGHT_POINTS
-TLS_KEX_RSA_PKCS_BAD = NO_POINTS
-TLS_KEX_RSA_PKCS_WORST_STATUS = STATUS_NOTICE
-
 WEB_TLS_KEX_HASH_FUNC_GOOD = FULL_WEIGHT_POINTS
 WEB_TLS_KEX_HASH_FUNC_OK = FULL_WEIGHT_POINTS
 WEB_TLS_KEX_HASH_FUNC_BAD = NO_POINTS

checks/tasks/tls/tls_constants.py

@@ -132,16 +132,6 @@
     (OpenSslDigestNidEnum.SHA224, OpenSslEvpPkeyEnum.RSA),
     (OpenSslDigestNidEnum.SHA224, OpenSslEvpPkeyEnum.DSA),
 ]
-# NCSC 3.3.2.1: RSA PKCS must not be used.
-# Failing these algs means the server has no RSA or RSA in PSS only, either is fine.
-SIGNATURE_ALGORITHMS_RSA_PKCS = [
-    # (OpenSslDigestNidEnum.MD5, OpenSslEvpPkeyEnum.RSA),
-    (OpenSslDigestNidEnum.SHA1, OpenSslEvpPkeyEnum.RSA),
-    (OpenSslDigestNidEnum.SHA224, OpenSslEvpPkeyEnum.RSA),
-    (OpenSslDigestNidEnum.SHA512, OpenSslEvpPkeyEnum.RSA),
-    (OpenSslDigestNidEnum.SHA384, OpenSslEvpPkeyEnum.RSA),
-    (OpenSslDigestNidEnum.SHA256, OpenSslEvpPkeyEnum.RSA),
-]
 
 # Mail servers with an increased connection limit,
 # matched by substring matching on their hostname.