4
$\begingroup$

I'm signing mails with the RSASSA-PSS (p1v2.1) certificate. When I click Details, it shows "Signature Algorithm: RSASSA-PSS". openssl x509 -text shows

    Signature Algorithm: rsassaPss
     Hash Algorithm: sha256
     Mask Algorithm: mgf1 with sha256

certutil -dump shows:

1.2.840.113549.1.1.10 RSASSA-PSS

Now, whem I send my signed emails and click on Details in outlook, it shows "Signature Algorithm: RSA (2048)"

I'm using bouncycastle for signing and when I use "SHA256WithRSAEncryption" it works fine, but when I'm using "SHA256WithRSAAndMGF1" Signature, Outlook tells me "The digital signature on this item is Invalid or Not Trusted." and when I click details, I see "Signature Algorithm: RSA (2048)". Is p#1v2.1 still not supported by outlook/microsoft or am I just crazy?

$\endgroup$
2
  • $\begingroup$ Why a program does not accept a signature format is off-topic here; I'm thus thinking of migrating to security-SE. That said, one possibility worth checking would be that the hash algorithm used in MGF1 is not the same on both sides: it's not specified by SHA256WithRSAAndMGF1. I have been hit (in encryption, not signature) by Java libraries where MGF1 is by default understood to use SHA-1 even when the algorithm's name mentions SHA-256, see this. $\endgroup$ – fgrieu Mar 14 at 8:33
  • $\begingroup$ Note: as of 2020 this apparently wasn't supported, see the conversation here with an (initially helpful) Jenifer from Microsoft trying to fill the gaps, but getting wrong footed by her own engineers. $\endgroup$ – Maarten Bodewes Mar 16 at 13:17
1
$\begingroup$

Is p#1v2.1 still not supported by outlook/microsoft or am I just crazy?

PSS seems still not introduced to Microsoft, please see here. It's a long discussion, but in the end it seems that you cannot select PSS as a signature scheme when sending, I presume that also means that PSS signatures are not accepted.

RSA-OAEP based encryption is generally supported earlier than PSS. There are padding oracle attacks against the PKCS#1 v1.5 encryption scheme. The PKCS#1 v1.5 signature scheme is still considered secure, so there is much less need for upgrading it.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.