Which of these should I be using? PKCS1 v1.5 seems a bit simpler to implement.
Generally you should not be implementing this yourself, there are plenty of libraries that implement these schemes out of the box.
Both the PKCS#1 v1.5 padding for signature generation and PSS padding have pro's and con's which I list below. Which one you decide to use it up to you.
Are there security concerns with each schemes I should be aware of?
PKCS#1 v1.5 padding has the following drawbacks.
- It is deterministic, which is not a requirement for signatures and this can actually be detrimental to security in some very specific situations.
- It's missing a security proof; PSS has a security proof (for the padding mode, not for RSA itself of course). That said, PKCS#1 v1.5 padding for signature generation has not been broken (unlike PKCS#1 v1.5 padding for encryption, which does have vulnerabilities).
PSS has drawbacks as well:
- it is more complex to implement;
- it is definitely not as prevalent as PKCS#1 v1.5 padding - probably because PKCS#1 v1.5 padding is older and hasn't been broken;
- it requires configuration (both during signature generation and verification).
If I need to use PSS, what digest should I be using? Is SHA1 a concern if used?
SHA-1 is definitely an issue if you would use it for hashing the message as part of the signature generation (regardless of the padding mode), as it isn't collision resistant anymore. A collision resistant hash is a requirement for signature generation algorithm.
PSS uses another instance of a hash function for PSS padding for a function called the mask generation function (MGF) which performs the actual padding. MGF1 is the only MGF defined for PSS, and it in turn requires a hash to create the PSS padding: the data hash value is input for MGF1. MGF1 can be compared to HMAC when it comes to security, and SHA-1 is still secure in HMAC.
So SHA-1 isn't a problem if you just use it for the underlying MGF1 used within PSS padding. Of course, for new protocols you'd still go for a more secure cryptographic hash function such as SHA-512.
The two hash functions algorithms can be different than the one used for the data hashing. Some implementations default to SHA-1 and some default to the data hash algorithms. For some reason SHA-256 is often preferred for MGF1 although SHA-512 would make a lot more sense for RSA because it would be more efficient because of its larger output size. As indicated, complexity is a drawback of PSS - even when it comes to configuring the algorithm.
Quite often the hash used in MGF1 it is set to the same hash as used for hashing the message, and that's probably best if you want to remain compatible with most applications & libraries.
If you decide to use PKCS#1 PSS padding, be sure you document the algorithm you use for both the data and the MGF1 function.