2
$\begingroup$

For a signing scheme involving generating a $256$ bit digest using SHA256 followed by RSA with $2048$ bit modulus, the signature would always be 256 bit without padding even though sigantures of up to $2048$ bits are allowed in the RSA scheme that follows.
As such, is there a need to pad the $256$ bit digest to improve security?

$\endgroup$
  • 1
    $\begingroup$ Did you see PSS $\endgroup$ – kelalaka Feb 4 at 10:14
4
$\begingroup$

For a signing scheme involving generating a 256-bit digest using SHA-256 followed by RSA with 2048-bit modulus, the signature would always be 256-bit without padding..

That assertion is wrong. For every RSA signature scheme, the signature is always at least as wide as the modulus (or next to that; there are tricks to reduce it by a few bits). Much shorter signatures are not verifiable.

Is there a need to pad the 256-bit digest to improve security?

If the question asks whether a more elaborate padding scheme than signing message $M$ as $(\operatorname{SHA-256}(M))^d\bmod N$ is needed: Yes. Otherwise, an existential forgery might be possible per a variant of the Desmedt and Odlyzko attack; it is feasible at least for a 200-bit hash.


Common RSA signature schemes:

  • RSASSA-PSS of PKCS#1v2.2. It is a randomized RSA signature scheme with appendix (that is, with the signature appended to the unmodified message). It has a strong security reduction to the RSA problem (finding $M$ from $M^e\bmod N$ for random $M$). It remains secure (assuming slightly stronger hypothesis) if it's randomness source is stuck.
  • ISO/IEC 9796-2 scheme 2. It is a randomized RSA signature scheme with message recovery (that is, with some or all of the message conveyed in the signature itself, saving bandwidth). It has a strong security reduction to the RSA problem. It remains secure (assuming slightly stronger hypothesis) if it's randomness source is stuck.
  • ISO/IEC 9796-2 scheme 3. It is a deterministic RSA signature scheme with message recovery, equivalent to scheme 2 above with no randomness, and maximum ability to embed data in the signature (size of the modulus, minus hash width and 2 bytes). It inherits scheme 2's security reduction.
  • RSASSA-PKCS1-v1_5 of PKCS#1v2.2. It is a deterministic signature scheme with appendix. There is no known attack against this scheme, but no security reduction.
  • ISO/IEC 9796-2 scheme 1, a deterministic RSA signature scheme with message recovery. There is an existential forgery against this scheme when the adversary can obtain signature of chosen messages, thus the (fully compatible) scheme 3 should be used in all new systems.
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.