Before today I didn't know the difference between RSA padding for encryption and for signing, I think this answer describes it pretty succinctly, however, I don't know if there is an optimal padding to use or if there are any deficiencies in current paddings I should be wary of (for example, PKCS for RSA encryption).

I came across RSA-FDH and RSASSA-PSS, but don't know if there are any other paddings available for RSA signing or if the ones I mentioned have any known weaknesses/deficiencies.

  • 3
    $\begingroup$ Both RSA-FDH and RSASSA-PSS have security proofs. They mostly differ in details (can you construct large-output hashes? do you mind deterministic signatures? Do you need a widely supported scheme?) $\endgroup$ – SEJPM Feb 20 '18 at 17:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.