# What is RSA-PSS and how is it different from a hash?

I can't find any usable resources about it online (at least ones that make sense to me right now), so any links to articles or if you could explain it to me would be greatly appreciated.

What I don't understand is what is PSS? I understand that RSA is an encryption type with two keys (usually public and private), but is PSS a signature (like the name suggests) and if so, how is it different from a hash?

A fixed hash function can be computed by anyone.

A signature depends also on a public key, and can be computed only by someone who knows a secret related to the public key. Anyone can verify a signature on a message under the public key, but only knowledge of the secret enables creating signatures. Signatures practically always involve the use of a hash function internally, combining the hash output (and sometimes hash input) with the public key using obscure mathematical spells.

RSA is not itself an encryption algorithm; it is a family of trapdoor permutations, which are obscure mathematical spells not really useful in isolation. There are encryption schemes and signature schemes both built out of the RSA trapdoor permutation family, such as RSAES-OAEP and RSASSA-PSS.

The paper : PSS: Provably Secure Encoding Method for Digital Signatures by Bellare and Rogaway in August 1998

RSA-PSS is a signature scheme based on the RSA assumption, similar to how RSA encryption is an encryption scheme based on the RSA assumption. RSA-PSS was designed to be provably reducible to the hardness of the RSA problem, a property that the previous PKCS#1.5 scheme did not possess.

• Addition: the reduction to practice of RSA-PSS is RSASSA-PSS, of PKCS#1.
– fgrieu
Jan 20, 2023 at 9:06

While the above answers are correct, I would like to add something that would have helped me, if I knew it before.

A hash can always be computed by anyone. RSA goes a step further to use asymmetric encryption so that only the bearer of the private key is able to create valid signatures. The first versions of the algorithm had weaknesses (search for them, it is interesting). The PSS part (Probabilistic Signature Scheme) is an answer to some of the weaknesses. Basically it is about adding a padding to the data, generated by a mask generation function, that can later be removed during verification.

This also aids us in deciding how secure we can assume that the algorithm is. It is, among other reasons, helpful when someone (e.g. a governmental organization) wants to set a minimum security level for storing certain data. I believe NIST, ENISA and IETF provide such estimates for the security level of RSA cryptosystems.