I just need to know is it correct to classify the RSASSAPSS scheme and sha[256 | 512 | 1]WithRSAEncryption all under RSA signature?

  • $\begingroup$ The CMS standards are not controlling for TLS certificates; TLS standards refer directly to PKIX, in this case (PSS) 4055 updating 3279. Although sha1 sha256 sha512 are the most-used hashes for SSA-v1_5, the other sha2's from 3447+ are presumably allowed, though now I look I don't see an explicit adoption; I'm sure I've seen sha384withRSA used but don't recall the others. (3279 also allowed md2 and md5, but they are now broken.) $\endgroup$ – dave_thompson_085 Dec 16 '18 at 8:31
  • 1
    $\begingroup$ sha256WithRSAEncryption is indeed a signature algorithm. Poor name, if you ask. But that's official. $\endgroup$ – fgrieu Dec 20 '18 at 13:12

Yeah, of course, your RFC has references:

PSS Algorithm

Although there are no known defects with the PKCS #1 v1.5 [P1v1.5] signature algorithm, RSASSA-PSS [P1v2.1] was developed in an effort to have more mathematically provable security. PKCS #1 v1.5 signatures were developed in an ad hoc manner; RSASSA-PSS was developed based on mathematical foundations.

If you follow that link you find that it was defined in RFC 3447, which is called the "Public-Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications Version 2.1". So these are the official standards from RSA Laboratories, except in RFC form. There is also v2.2 which just defines a different set of hash functions, of which only SHA-224 is moderately interesting in the given setting.

In full, the algorithm name is RSA (Rivest, Shamir, Adleman, after the team that thought it out), Signature Scheme with Appendix for SSA, and finally Probabilistic Signature Scheme for PSS. Commonly we just call it RSA-PSS or just PSS though.

  • $\begingroup$ Nit: v2.2 adds 3 hashes (sha-224, sha-512/224, sha-512/256) and 'retires' (but doesn't delete) md2, and no longer recommends sha1 for new SSA-v1_5. And is available as RFC8017. Bonus: while confirming this I found two errors and reported them, so your mistake benefited society -- at least the Internet cryptography part of society -- at least a little :-} $\endgroup$ – dave_thompson_085 Dec 16 '18 at 8:00
  • $\begingroup$ I just knew there were some other parts to it (but I guess most of the time they will be ignored). Still haven't seen any of the other SHA-2 hashes around either. Thanks for the update. $\endgroup$ – Maarten Bodewes Dec 16 '18 at 12:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.