1
$\begingroup$

We are working on the web application that is basically generating a self-signed certificate during the installation. It's a Java based app and for generation of the certificate we are using SHA512withRSA. Can I ask what would be the best replacement for it? Something with better encryption level and more 'modern' security?

Any help would be appreciated.

-- Best regards macosxgeek

Improve this question
$\endgroup$
4
  • 4
    $\begingroup$ There is nothing really wrong with SHA512withRSA. Without any requirements but "being more modern" or "better" this can only lead to opinionated answers, and therefore this question is off topic. $\endgroup$
    – Maarten Bodewes ♦
    Commented Jul 11, 2018 at 12:47
  • $\begingroup$ Thank you Maarten, will take that into the consideration and will try to be more specific with my future questions. I'm totally new to cryptography and still need to learn a lot of stuff. $\endgroup$
    – macosxgeek
    Commented Jul 11, 2018 at 15:45
  • 1
    $\begingroup$ Much more important: Do you have a design document explaining your system's security model—what resources it uses to achieve what goals for whom, what the powers the adversary has to subvert some of the resources, and what you hope to guarantee to the legitimate parties that the adversary can't do in spite of that power? The choice of cryptodoohickeys in certificate knobs & whistles is only a tiny part of that; the security model will inform the choice of cryptodoohickeys, and an auditor will need to know how the whole system fits together so they can assess whether the choice makes sense. $\endgroup$
    – Squeamish Ossifrage
    Commented Jul 11, 2018 at 16:55
  • 1
    $\begingroup$ The signature on a selfsigned certificate provides absolutely no security at all ever; it's just filler to simplify the software. It could be MD2 plus RSA-512 without decreasing security -- at least not directly; the amount of time you would waste explaining/justifying this to ignorant and unthinking people might prevent you from completing other security-relevant tasks. For child certs OTOH the picture is completely different, and SHA512-RSA2k or better is fine (although to 'balance' SHA512 collision strength you need about RSA16k or ECDSA521 or maybe Ed448). $\endgroup$
    – dave_thompson_085
    Commented Jul 12, 2018 at 4:04

1 Answer 1

Reset to default
6
$\begingroup$

In standard Java libraries, SHA512withRSA designates signature per RSASSA-PKCS1-v1_5 with SHA-512. There is no known attack when used with a sufficient RSA modulus size, and SHA-512 is very secure. Given that SHA-512 has a 19-byte DER DigestInfo prefix, and that PKCS1-v1_5 signature further requires 10 bytes and 1 bit more for the modulus, we can tell from the question that the RSA public modulus size is at least 1+(10+19)×8+512=745-bit, but that's far from satisfactory.

The only truly indispensable thing to do is check that RSA public modulus size. Anything below 1024-bit is unsafe, anything below 2048-bit is to upgrade ASAP, when performance is no issue 4096-bit is reasonable, unless we care about quantum computers usable for cryptanalysis, or fairies (there's abundant literature about both).

It might be useful to also switch to RSASSA-PSS (which has a better security argument), but that's a bigger change (including in Known Answer Tests, since RSASSA-PSS signatures change randomly for the same data). It should also be ascertained that MFG1 in RSASSA-PSS does not use SHA-1; that would not be insecure, but is criticizable nevertheless, and often creeps in upgrades from RSAES-PKCS1-v1_5 to RSAES-OAEP in Java code, see this.

Improve this answer
$\endgroup$
3
  • $\begingroup$ This is absolutely brilliant ! Many thanks - much appreciate. $\endgroup$
    – macosxgeek
    Commented Jul 11, 2018 at 15:46
  • $\begingroup$ As a frequent fantasy reader, I would be interested in reading recommendations about the impact of fairies on cracking RSA signatures. $\endgroup$
    – Gilles 'SO- stop being evil'
    Commented Jul 11, 2018 at 19:17
  • $\begingroup$ @Gilles: here is one with the right keywords in the right context (though too down-to-earth for proper illustration of this answer). Looking for something better, but don't hold your breath. $\endgroup$
    – fgrieu ♦
    Commented Jul 11, 2018 at 19:42

Not the answer you're looking for? Browse other questions tagged or ask your own question.