I know there are several available, however I can't seem to find whether there is one standard one or not.

I think I understand the process of digital signatures, just wondering which has function is used.


  • 1
    $\begingroup$ SHA-256 and (deprecated) SHA-1. $\endgroup$
    – SEJPM
    Commented Nov 28, 2015 at 17:50
  • $\begingroup$ @SEJPM Would I be correct to say that the message is put through the hash function first, and the signature is calculated from the digest? $\endgroup$
    – Ali
    Commented Nov 28, 2015 at 18:07
  • 1
    $\begingroup$ Pretty much but with minor differences. See RSA-FDH and PKCS#1. $\endgroup$
    – SEJPM
    Commented Nov 28, 2015 at 18:10

1 Answer 1


In general there is no default hash algorithm in the PKCS#1 standards, neither for RSA with PKCS#1 v1.5 padding or RSA with PSS. Both these schemes are defined in RFC 3447 RSA PKCS#1 v2.1. Note that PKCS#1 v2.2 adds a few SHA-2 hash functions (SHA-224 and SHA-512/224 and SHA-512/256) to the mix - neither of which makes much sense.

PSS uses a Mask Generation Function MGF1 which defaults to SHA-1:

The default mask generation function is MGF1 with SHA-1

however, that's not the hash used to hash the message itself, it's just used to pre-process the hash before modular exponentiation. The strength of the hash used for MGF1 is not that important.

Many API's that have been around for some time rely on SHA-1 as a default. MD5 and SHA-1 have been around for a long time, and most libraries seemed to have taken the more secure SHA-1 as more future proof. You might find very old libraries that default on MD5, but I haven't come across them yet.

The low level security of SHA-1 shows one of the reasons why defaults should not be used. Once a library sets a default, it's impossible to get rid of, even if the default algorithm - SHA-1 in this case - is found to be insecure. Explicit parameterization is much better. It may require some initial effort when coding, but that is easily recovered during the maintenance phase of software.

Usually the specific SHA-2 algorithm needs to be configured in API's if SHA-2 is to be used. That's also because there is more than one SHA-2 algorithm: there are 2, with 6 variants in total. SHA-3 has 4 variants, so I don't expect this to change in the future. Furthermore, it has two SHAKE variants, SHAKE128 and SHAKE256 that can be used for RSA-FDH.

  • $\begingroup$ I guess you don't count the SHAKEs to SHA-3? $\endgroup$
    – SEJPM
    Commented Nov 28, 2015 at 22:16
  • $\begingroup$ Good point, those could be used for RSA-FDH, right? $\endgroup$
    – Maarten Bodewes
    Commented Nov 28, 2015 at 22:22
  • $\begingroup$ Yes indeed $\endgroup$
    – SEJPM
    Commented Nov 28, 2015 at 22:23
  • $\begingroup$ Let me just say D'oi to that! $\endgroup$
    – Maarten Bodewes
    Commented Nov 29, 2015 at 12:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.