# Could someone please explain test vectors of NIST for RSASSA-PSS 1024 bit?

I am new to RSASSA-PSS Signature verification algorithm. Below are the test vectors from NIST but i am not able to understand each parameter.

I could understand that SHA1 is used for Hashing and e stands for exponent but not other parameters?

Also, Can someone pls provide link of NIST test vectors of RSASSA-PSS with 3072 bit?

Could someone pls explain about what is n,p,q,e,d,Msg,S,SaltVal,EM with hash moved and Result = F(4 - Format of the EM is incorrect - hash moved to left) from below NIST test vector? what this Result parameter actually conveys?

[mod = 1024]
p = f71840f8a6472ebdc7f54d9884e86428ebd368324d87298fa00d9ccfb3d9afc21e0e2a10b15eb4a08f80cca7268a36a762f4900866a6a07419f9543ac3101a8b
q = f520558d02718b19a113fec43f4d086b76bb50e6d83772f1b07131b60a19a2baa553715df82a9e5dece4c79a5388949bcd9cf6a6c8c010903e681e195d3b5937
SHAAlg = SHA1
e = 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090c6d3
SaltVal = 2393183e18581e6924cd38f24192d1acc145633a
EM with hash moved = 0001ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff003021300906052b0e03021a050004142f2d655ebb3b3b81c73bb9bf8e420ffa7f7ecc3fefefefefefefefefef
Result = F (4 - Format of the EM is incorrect - hash moved to left )

• p and q are the primes used to generate the modulus N, d is the decryption/signing exponent. Msg is the message, S is the signature. I suppose that's the general idea. Jul 3, 2017 at 5:19
• For verification, I can use the exponent(e) ,Modulus - 1024,Msg and can expect the Signature(S), am i right? what is EM with hash moved? and what s the significance of Result parameter ? Jul 3, 2017 at 5:45

In Result = F (4 - Format of the EM is incorrect - hash moved to left ), the first F says that a correct signature verification implementation must Fail to verify the test vector (for known-good vectors, there is Result = P for Pass). What's in parenthesis following F documents the intention in making the test vector, but that's purely informative.

My guess is that this particular one means that the test vector is believed having been generated with the hash field too much on the left, eating some padding. But looking at EM with hash moved value, this clearly contains an EM for RSAES-PKCS1-v1_5 except the PS field is too short and garbage is inserted on the right, and I can't make sense of that in an RSASSA-PSS test suite. But who cares that a test vector expected to fail is nonsense? The point is that it is rejected; test vectors have poor coverage of possible errors in signature verification code anyway.

Update following comment: There are valid Pass test vectors for 3072-bit RSASSA-PSS in the FIPS 186-3 test vectors, file SigVerPSS_186-3.rsp, from which the question seems to be extracted. The mildly hard thing is extracting them out of the ocean of Fail vectors. Towards this, find immediately above some Result = P the values of SaltVal, S (3072-bit), Msg, d, e, SHAAlg; then somewhere above a value of n (3072-bit); check that d, e, n match by verifying that $2^{ed}\bmod n=2$, then forget about d; you have your test vector! Here is one:

n = ce4924ff470fb99d17f66595561a74ded22092d1dc27122ae15ca8cac4bfae11daa9e37a941430dd1b81aaf472f320835ee2fe744c83f1320882a8a02316ceb375f5c4909232bb2c6520b249c88be4f47b8b86fdd93678c69e64f50089e907a5504fdd43f0cad24aaa9e317ef2ecade3b5c1fd31f3c327d70a0e2d4867e6fe3f26272e8b6a3cce17843e359b82eb7a4cad8c42460179cb6c07fa252efaec428fd5cae5208b298b255109026e21272424ec0c52e1e5f72c5ab06f5d2a05e77c193b647ec948bb844e0c2ef1307f53cb800d4f55523d86038bb9e21099a861b6b9bcc969e5dddbdf7171b37d616381b78c3b22ef66510b2765d9617556b175599879d8558100ad90b830e87ad460a22108baa5ed0f2ba9dfc05167f8ab61fc9f8ae01603f9dd5e66ce1e642b604bca9294b57fb7c0d83f054bacf4454c298a272c44bc718f54605b91e0bfafd772aebaf3828846c93018f98e315708d50be8401eb9a8778dcbd0d6db9370860411b004cd37fbb8b5df87edee7aae949fff34607b
SHAAlg = SHA256
e = 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073b193