# Which algorithm should be used to replace SHA512withRSA? [closed]

We are working on the web application that is basically generating a self-signed certificate during the installation. It's a Java based app and for generation of the certificate we are using SHA512withRSA. Can I ask what would be the best replacement for it? Something with better encryption level and more 'modern' security?

Any help would be appreciated.

-- Best regards macosxgeek

## closed as primarily opinion-based by Maarten Bodewes♦, yyyyyyy, e-sushiJul 13 '18 at 22:53

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

• There is nothing really wrong with SHA512withRSA. Without any requirements but "being more modern" or "better" this can only lead to opinionated answers, and therefore this question is off topic. – Maarten Bodewes Jul 11 '18 at 12:47
• Thank you Maarten, will take that into the consideration and will try to be more specific with my future questions. I'm totally new to cryptography and still need to learn a lot of stuff. – macosxgeek Jul 11 '18 at 15:45
• Much more important: Do you have a design document explaining your system's security model—what resources it uses to achieve what goals for whom, what the powers the adversary has to subvert some of the resources, and what you hope to guarantee to the legitimate parties that the adversary can't do in spite of that power? The choice of cryptodoohickeys in certificate knobs & whistles is only a tiny part of that; the security model will inform the choice of cryptodoohickeys, and an auditor will need to know how the whole system fits together so they can assess whether the choice makes sense. – Squeamish Ossifrage Jul 11 '18 at 16:55
• The signature on a selfsigned certificate provides absolutely no security at all ever; it's just filler to simplify the software. It could be MD2 plus RSA-512 without decreasing security -- at least not directly; the amount of time you would waste explaining/justifying this to ignorant and unthinking people might prevent you from completing other security-relevant tasks. For child certs OTOH the picture is completely different, and SHA512-RSA2k or better is fine (although to 'balance' SHA512 collision strength you need about RSA16k or ECDSA521 or maybe Ed448). – dave_thompson_085 Jul 12 '18 at 4:04

In standard Java libraries, SHA512withRSA designates signature per RSASSA-PKCS1-v1_5 with SHA-512. There is no known attack when used with a sufficient RSA modulus size, and SHA-512 is very secure. Given that SHA-512 has a 19-byte DER DigestInfo prefix, and that PKCS1-v1_5 signature further requires 10 bytes and 1 bit more for the modulus, we can tell from the question that the RSA public modulus size is at least 1+(10+19)×8+512=745-bit, but that's far from satisfactory.