Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to understand how RSA digital signatures can incorporate any data from a PRNG into the final signature. Does this mean that separate implementations might fail to verify each others signatures if they chose a different method for coming up with random padding based on the input or a hash of the input?

Is this something that is different between RSASSA-PKCS1-v1_5 and RSASSA-PSS?

share|improve this question
up vote 3 down vote accepted

RSASSA-PKCS1-v1_5 does not use random padding, the scheme is deterministic.

RSASSA-PSS is different from other RSA-based signature schemes in that it is probabilistic rather than deterministic, incorporating a randomly generated salt value.

The signature is verified using a hash over the message hash and the salt. So the verifier does not need to know how the random is generated, it will just verify the hash over it. Check steps 9 to 14 of the PSS signature verification of RFC 3447 paragraph 9.1.2.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.