Skip to main content
replaced https://tools.ietf.org/html/rfc with https://www.rfc-editor.org/rfc/rfc
Source Link

As to the specs, note that 4.74.7 says

In RSA signing, the opaque vector contains the signature generated
using the RSASSA-PKCS1-v1_5 signature scheme defined in [PKCS1]. ...

referencing (then-current) RFC3447 which unambiguously defines the whole signature process: hash, then encode, then pad, then the RSA modular exponentiation.

Note that TLS DSA and ECDSA signatures are just the standard notSchnorr(hash(M)) but TLS1.2 (protocol) RSA signatures are PKCS1v1_5 which is in brief

$$\operatorname{modexp}(n,d) (\operatorname{add01FF...00} (\operatorname{DERSEQ} (\operatorname{hash}(M)))))$$

while in TLS1.1 and earlier they were a variant of PKCS 'type 1' or even 'type 0' $$\operatorname{modexp}(n,d) (\operatorname{maybe\_add01FF...00} (\operatorname{SHA1concatMD5}(M)))$$ -- as noted in that same paragraph. And TLS1.3 changes to PSS instead.

Meta: Mathjax somewhat better, thanks SEJPM.

As to the specs, note that 4.7 says

In RSA signing, the opaque vector contains the signature generated
using the RSASSA-PKCS1-v1_5 signature scheme defined in [PKCS1]. ...

referencing (then-current) RFC3447 which unambiguously defines the whole signature process: hash, then encode, then pad, then the RSA modular exponentiation.

Note that TLS DSA and ECDSA signatures are just the standard notSchnorr(hash(M)) but TLS1.2 (protocol) RSA signatures are PKCS1v1_5 which is in brief

$$\operatorname{modexp}(n,d) (\operatorname{add01FF...00} (\operatorname{DERSEQ} (\operatorname{hash}(M)))))$$

while in TLS1.1 and earlier they were a variant of PKCS 'type 1' or even 'type 0' $$\operatorname{modexp}(n,d) (\operatorname{maybe\_add01FF...00} (\operatorname{SHA1concatMD5}(M)))$$ -- as noted in that same paragraph. And TLS1.3 changes to PSS instead.

Meta: Mathjax somewhat better, thanks SEJPM.

As to the specs, note that 4.7 says

In RSA signing, the opaque vector contains the signature generated
using the RSASSA-PKCS1-v1_5 signature scheme defined in [PKCS1]. ...

referencing (then-current) RFC3447 which unambiguously defines the whole signature process: hash, then encode, then pad, then the RSA modular exponentiation.

Note that TLS DSA and ECDSA signatures are just the standard notSchnorr(hash(M)) but TLS1.2 (protocol) RSA signatures are PKCS1v1_5 which is in brief

$$\operatorname{modexp}(n,d) (\operatorname{add01FF...00} (\operatorname{DERSEQ} (\operatorname{hash}(M)))))$$

while in TLS1.1 and earlier they were a variant of PKCS 'type 1' or even 'type 0' $$\operatorname{modexp}(n,d) (\operatorname{maybe\_add01FF...00} (\operatorname{SHA1concatMD5}(M)))$$ -- as noted in that same paragraph. And TLS1.3 changes to PSS instead.

Meta: Mathjax somewhat better, thanks SEJPM.

added 66 characters in body
Source Link
dave_thompson_085
  • 6.5k
  • 1
  • 21
  • 24

As to the specs, note that 4.7 says

In RSA signing, the opaque vector contains the signature generated
using the RSASSA-PKCS1-v1_5 signature scheme defined in [PKCS1]. ...

referencing (then-current) RFC3447 which unambiguously defines the whole signature process: hash, then encode, then pad, then the RSA modular exponentiation.

Note that TLS DSA and ECDSA signatures are just the standard notSchnorr(hash(M)) but TLS1.2 (protocol) RSA signatures are PKCS1v1_5 which is in brief

$$modexp(n,d) (add01FF...00 (DERSEQOIDandOCTSTRING (hash(M)))))$$$$\operatorname{modexp}(n,d) (\operatorname{add01FF...00} (\operatorname{DERSEQ} (\operatorname{hash}(M)))))$$

while in TLS1.1 and earlier they were a variant of PKCS 'type 1' or even 'type 0' $$modexp(n,d) (add01FF...00or1.0addnothing (SHA1concatMD5(M)))$$$$\operatorname{modexp}(n,d) (\operatorname{maybe\_add01FF...00} (\operatorname{SHA1concatMD5}(M)))$$ -- as noted in that same paragraph. And TLS1.3 changes to PSS instead.

Meta: yes my Mathjax is ugly; anyone who knows how to improve it feel freesomewhat better, thanks SEJPM.

As to the specs, note that 4.7 says

In RSA signing, the opaque vector contains the signature generated
using the RSASSA-PKCS1-v1_5 signature scheme defined in [PKCS1]. ...

referencing (then-current) RFC3447 which unambiguously defines the whole signature process: hash, then encode, then pad, then the RSA modular exponentiation.

Note that TLS DSA and ECDSA signatures are just the standard notSchnorr(hash(M)) but TLS1.2 (protocol) RSA signatures are PKCS1v1_5 which is

$$modexp(n,d) (add01FF...00 (DERSEQOIDandOCTSTRING (hash(M)))))$$ while in TLS1.1 and earlier they were a variant of PKCS 'type 1' or even 'type 0' $$modexp(n,d) (add01FF...00or1.0addnothing (SHA1concatMD5(M)))$$ -- as noted in that same paragraph. And TLS1.3 changes to PSS instead.

Meta: yes my Mathjax is ugly; anyone who knows how to improve it feel free.

As to the specs, note that 4.7 says

In RSA signing, the opaque vector contains the signature generated
using the RSASSA-PKCS1-v1_5 signature scheme defined in [PKCS1]. ...

referencing (then-current) RFC3447 which unambiguously defines the whole signature process: hash, then encode, then pad, then the RSA modular exponentiation.

Note that TLS DSA and ECDSA signatures are just the standard notSchnorr(hash(M)) but TLS1.2 (protocol) RSA signatures are PKCS1v1_5 which is in brief

$$\operatorname{modexp}(n,d) (\operatorname{add01FF...00} (\operatorname{DERSEQ} (\operatorname{hash}(M)))))$$

while in TLS1.1 and earlier they were a variant of PKCS 'type 1' or even 'type 0' $$\operatorname{modexp}(n,d) (\operatorname{maybe\_add01FF...00} (\operatorname{SHA1concatMD5}(M)))$$ -- as noted in that same paragraph. And TLS1.3 changes to PSS instead.

Meta: Mathjax somewhat better, thanks SEJPM.

Source Link
dave_thompson_085
  • 6.5k
  • 1
  • 21
  • 24

As to the specs, note that 4.7 says

In RSA signing, the opaque vector contains the signature generated
using the RSASSA-PKCS1-v1_5 signature scheme defined in [PKCS1]. ...

referencing (then-current) RFC3447 which unambiguously defines the whole signature process: hash, then encode, then pad, then the RSA modular exponentiation.

Note that TLS DSA and ECDSA signatures are just the standard notSchnorr(hash(M)) but TLS1.2 (protocol) RSA signatures are PKCS1v1_5 which is

$$modexp(n,d) (add01FF...00 (DERSEQOIDandOCTSTRING (hash(M)))))$$ while in TLS1.1 and earlier they were a variant of PKCS 'type 1' or even 'type 0' $$modexp(n,d) (add01FF...00or1.0addnothing (SHA1concatMD5(M)))$$ -- as noted in that same paragraph. And TLS1.3 changes to PSS instead.

Meta: yes my Mathjax is ugly; anyone who knows how to improve it feel free.