Why does OpenSSL differentiate between PSS and non-PSS for private key generation?

Question

RSA-PSS private keys

The following command will generate an RSA-PSS private key:

openssl genpkey -algorithm rsa-pss -pkeyopt rsa_keygen_bits:2048 -pkeyopt rsa_keygen_pubexp:65537 -out CA.priKey

Here's a sample one I just generated:

https://pastebin.com/AQk0gkkT

Here's the asn1parse output:

    0:d=0  hl=4 l=1213 cons: SEQUENCE
    4:d=1  hl=2 l=   1 prim:  INTEGER           :00
    7:d=1  hl=2 l=  11 cons:  SEQUENCE
    9:d=2  hl=2 l=   9 prim:   OBJECT            :rsassaPss
   20:d=1  hl=4 l=1193 prim:  OCTET STRING

Regular RSA private keys

This command, in contrast, will generate a regular RSA private key:

Here's a sample one I just generated:

https://pastebin.com/s6gES7hr

Here's the asn1parse output:

    0:d=0  hl=4 l=1213 cons: SEQUENCE
    4:d=1  hl=2 l=   1 prim:  INTEGER           :00
    7:d=1  hl=2 l=  13 cons:  SEQUENCE
    9:d=2  hl=2 l=   9 prim:   OBJECT            :rsaEncryption
   20:d=2  hl=2 l=   0 prim:   NULL
   22:d=1  hl=4 l=1191 prim:  OCTET STRING

My question

Why do RSA-PSS private keys have their own format? The probabilistic signature scheme (PSS) affects how the signatures are made. At least according to PKCS#1 v2.2. The keys are the same. They both make use of the same CRT parameters and what not. So why two different OIDs in this context? Is there a difference or is this just OpenSSL being dumb? And are there any other OIDs OpenSSL might be using to represent RSA private keys?

Answer 1

If you reuse the same key material for different algorithms, you rely not on the security of any one algorithm individually, but on the security of the composition of the two algorithms simultaneously.

For a particularly egregious example, if you use the same RSA public key for RSASSA-PKCS1-v1_5 and for HMAC-SHA256, the results might be entertaining.

It may turn out that while we have high confidence in the security of RSASSA-PSS assuming the RSA problem is hard, and reasonable confidence in the security of RSASSA-PKCS1-v1_5 because after decades nobody's made progress on it, the combination of the two with the same key material could have catastrophic results.

The theory behind these tags is presumably that associating such metadata with the key may serve to reduce the danger of accidentally reusing the same key material for different cryptosystems.

Answer 2

OpenSSL is not being dumb and there is a reason the keys have different OIDs, but it's unrelated to the key data — it's the key metadata. The metadata describes the key. Specifically, the ASN.1 type above is PrivateKeyInfo and the difference is in the AlgorithmIdentifier. From an organizational perspective where you have to keep track of two RSA private keys designated for different usages, these ASN.1 differences add value.

For example, when you create a CSR for your signing certificate (and that is its only intedend usage — which can be further enforced by the X.509 V3 extensions Key Usage or Extended Key Usage), you'd know to use the key with the OID of rsassaPss.

Answer 3

For the private key it may or may not matter to code using the key, but for the public key especially in a CSR or cert the algorithm identifier is visible and can matter. OpenSSL generates a CSR containg a public key which is automatically extracted from the private key, including the AlgId, which is normally copied to a cert where the AlgId in the public key can be significant.

For example, TLS 1.3 uses different signature algorithm (aka scheme) codes for RSA-PSS signatures depending on whether they use a certificate that has an AlgId with rsaEncryption 1.2.840.113549.1.1 or id-RSASSA-PSS 1.2.840.113549.1.10.