I am trying to understand how RSA digital signatures can incorporate any data from a PRNG into the final signature. Does this mean that separate implementations might fail to verify each others signatures if they chose a different method for coming up with random padding based on the input or a hash of the input?

Is this something that is different between RSASSA-PKCS1-v1_5 and RSASSA-PSS?


1 Answer 1


RSASSA-PKCS1-v1_5 does not use random padding, the scheme is deterministic.

RSASSA-PSS is different from other RSA-based signature schemes in that it is probabilistic rather than deterministic, incorporating a randomly generated salt value.

The signature is verified using a hash over the message hash and the salt. So the verifier does not need to know how the random is generated, it will just verify the hash over it. Check steps 9 to 14 of the PSS signature verification of RFC 3447 paragraph 9.1.2.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.