I know there are several available, however I can't seem to find whether there is one standard one or not.
I think I understand the process of digital signatures, just wondering which has function is used.
Thanks
$\begingroup$
$\endgroup$
3
-
1$\begingroup$ SHA-256 and (deprecated) SHA-1. $\endgroup$– SEJPMCommented Nov 28, 2015 at 17:50
-
$\begingroup$ @SEJPM Would I be correct to say that the message is put through the hash function first, and the signature is calculated from the digest? $\endgroup$– AliCommented Nov 28, 2015 at 18:07
-
1$\begingroup$ Pretty much but with minor differences. See RSA-FDH and PKCS#1. $\endgroup$– SEJPMCommented Nov 28, 2015 at 18:10
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
4
In general there is no default hash algorithm in the PKCS#1 standards, neither for RSA with PKCS#1 v1.5 padding or RSA with PSS. Both these schemes are defined in RFC 3447 RSA PKCS#1 v2.1. Note that PKCS#1 v2.2 adds a few SHA-2 hash functions (SHA-224 and SHA-512/224 and SHA-512/256) to the mix - neither of which makes much sense.
PSS uses a Mask Generation Function MGF1 which defaults to SHA-1:
The default mask generation function is MGF1 with SHA-1
however, that's not the hash used to hash the message itself, it's just used to pre-process the hash before modular exponentiation. The strength of the hash used for MGF1 is not that important.
Many API's that have been around for some time rely on SHA-1 as a default. MD5 and SHA-1 have been around for a long time, and most libraries seemed to have taken the more secure SHA-1 as more future proof. You might find very old libraries that default on MD5, but I haven't come across them yet.
The low level security of SHA-1 shows one of the reasons why defaults should not be used. Once a library sets a default, it's impossible to get rid of, even if the default algorithm - SHA-1 in this case - is found to be insecure. Explicit parameterization is much better. It may require some initial effort when coding, but that is easily recovered during the maintenance phase of software.
Usually the specific SHA-2 algorithm needs to be configured in API's if SHA-2 is to be used. That's also because there is more than one SHA-2 algorithm: there are 2, with 6 variants in total. SHA-3 has 4 variants, so I don't expect this to change in the future. Furthermore, it has two SHAKE variants, SHAKE128 and SHAKE256 that can be used for RSA-FDH.
answered Nov 28, 2015 at 22:07
-
$\begingroup$ I guess you don't count the SHAKEs to SHA-3? $\endgroup$– SEJPMCommented Nov 28, 2015 at 22:16
-
$\begingroup$ Good point, those could be used for RSA-FDH, right? $\endgroup$– Maarten Bodewes ♦Commented Nov 28, 2015 at 22:22
-
-
$\begingroup$ Let me just say D'oi to that! $\endgroup$– Maarten Bodewes ♦Commented Nov 29, 2015 at 12:40