Which of these should I be using? PKCS1 v1.5 seems a bit simpler to implement.
Generally you should not be implementing this yourself, there are plenty of libraries that implement these schemes out of the box.
Both the PKCS#1 v1.5 padding for signature generation and PSS padding have pro's and con's which I list below. Which one you decide to use it up to you.
Are there security concerns with each schemes I should be aware of?
PKCS#1 v1.5 padding has two drawbacks.
- It is deterministic, which is not a requirement for signatures and this can actually be detrimental to security in some very specific situations.
- It's missing a security proof; PSS has a security proof (for the padding mode, not for RSA itself of course). That said, PKCS#1 v1.5 padding for signature generation has not been broken (unlike PKCS#1 v1.5 padding for encryption, which does have vulnerabilities).
PSS has two drawbacks as well:
- it is more complex to implement;
- it is definitely not as prevalent as PKCS#1 v1.5 padding - probably because PKCS#1 v1.5 padding is older and hasn't been broken.
If I need to use PSS, what digest should I be using? Is SHA1 a concern if used?
SHA-1 is definitely an issue if you would use it for hashing the data you use for the signature (regardless of the padding mode), as it isn't collision resistant anymore. A collision resistant hash is a requirement for signature generation algorithm.
SHA-1 isn't a problem if you just use it for the underlying MGF1 used within PSS padding. Of course, for new protocols you'd still go for a more secure cryptographic hash function such as SHA-512.
PSS uses another instance of a hash function for PSS padding for a function called the mask generation function (MGF) which performs the actual padding. MGF1 is the only MGF defined for PSS, and it in turn requires a hash to create the PSS padding: the data hash value is input for MGF1. MGF1 can be compared to HMAC when it comes to security, and SHA-1 is still secure in HMAC.
The two hash functions algorithms can be different than the one used for the data hashing. Some implementations default to SHA-1 and some default to the data hash algorithms. For some reason SHA-256 is often preferred for MGF1 although SHA-512 would make a lot more sense for RSA because it would be more efficient because of its larger output size. As indicated, complexity is a drawback of PSS - even when it comes to configuring the algorithm.
If you decide to use PKCS#1 PSS padding, be sure you document the algorithm you use for both the data and the MGF1 function.