Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
I am trying to understand how RSA digital signatures can incorporate any data from a PRNG into the final signature. Does this mean that separate implementations might fail to verify each others signatures if they chose a different method for coming up with random padding based on the input or a hash of the input?
Is this something that is different between RSASSA-PKCS1-v1_5 and RSASSA-PSS?
RSASSA-PKCS1-v1_5 does not use random padding, the scheme is deterministic.
RSASSA-PSS is different from other RSA-based signature schemes in that it is probabilistic rather than deterministic, incorporating a randomly generated salt value.
The signature is verified using a hash over the message hash and the salt. So the verifier does not need to know how the random is generated, it will just verify the hash over it. Check steps 9 to 14 of the PSS signature verification of RFC 3447 paragraph 9.1.2.
