I'd like to understand what is the meaning of this field, especially considering that when calling a crypto library to sign data the digest method is specified by the caller. For example, this simple C# code:

RSACryptoServiceProvider rcsp = certs[0].PrivateKey as RSACryptoServiceProvider;
rcsp.SignData(data, "SHA256");

Why would I even specify the algorithm if it's dictated by the certificate? And what is the meaning of the resulting signature in the above code, if say, the signature hash algorithm in the certificate is sha1 and not sha256?


A typical X.509 certificate is the combination of data (including a public key $Pub_B$), and of a signature $Sig_A$ of that data, to be verified with an unrelated public key $Pub_A$. In order for the verifier to know which hash to use when verifying $Sig_A$, there is use for a field in said data specifying the hash used by $Sig_A$, and that's the purpose of signatureAlgorithm in said data. As RFC 3279 puts it:

Certificates and CRLs conforming to RFC 3280 may be signed with any public key signature algorithm. The certificate or CRL indicates the algorithm through an algorithm identifier which appears in the signatureAlgorithm field within the Certificate or CertificateList.

The signatures that will be verified with $Pub_B$ (produced with the corresponding private key by the certificate holder) use a hash (in your case, SHA-256) that may be different from the one used by $Pub_A$.

The signatureAlgorithm field remains useful after the signature $Sig_A$ is verified, since the trust we can have in $Pub_B$, and in anything signed using $Pub_B$, depends on how much we trust that hash.

Note: typical security "proofs" for digital signatures silently assume that a single hash is used in conjunction with a given key, and that the verifier knows which. It would therefore make a lot of sense that a certificate introduces $Pub_B$ only on the condition that it used to verify signatures in conjunction with a specified hash, or/and that by default that hash defaults to what was used in the certificate and is indicated by signatureAlgorithm; and I'm ready to bet that some PKIs using the X.509 certificate format do this.

|improve this answer|||||
  • $\begingroup$ So both PubA and PubB are stored in the certificate? When is PubA generated? Is PubA the key of the parent/root certificate? $\endgroup$ – Dandan Apr 14 '15 at 17:44
  • $\begingroup$ @Dandan: only $Pub_B$ is in the certificate that we are talking about in the question and answer. $Pub_A$ is the public key of the certification authority, is typically designated (not contained) in the certificate's data, and is known and trusted either because it is built in the software that verifies certificates, or because it is introduced by another certificate including a signature verified by yet another known and trusted public key. Sometime $Pub_A=Pub_B$, this is a self-signed certificate, and we can trust these only if they are known to come from a trusted source. $\endgroup$ – fgrieu Apr 14 '15 at 18:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.