Is padding of the digest needed in SHA256 with RSA-2048 scheme?

For a signing scheme involving generating a $$256$$ bit digest using SHA256 followed by RSA with $$2048$$ bit modulus, the signature would always be 256 bit without padding even though sigantures of up to $$2048$$ bits are allowed in the RSA scheme that follows.
As such, is there a need to pad the $$256$$ bit digest to improve security?

• Did you see PSS – kelalaka Feb 4 at 10:14

For a signing scheme involving generating a 256-bit digest using SHA-256 followed by RSA with 2048-bit modulus, the signature would always be 256-bit without padding..

That assertion is wrong. For every RSA signature scheme, the signature is always at least as wide as the modulus (or next to that; there are tricks to reduce it by a few bits). Much shorter signatures are not verifiable.

Is there a need to pad the 256-bit digest to improve security?

If the question asks whether a more elaborate padding scheme than signing message $$M$$ as $$(\operatorname{SHA-256}(M))^d\bmod N$$ is needed: Yes. Otherwise, an existential forgery might be possible per a variant of the Desmedt and Odlyzko attack; it is feasible at least for a 200-bit hash.

Common RSA signature schemes:

• RSASSA-PSS of PKCS#1v2.2. It is a randomized RSA signature scheme with appendix (that is, with the signature appended to the unmodified message). It has a strong security reduction to the RSA problem (finding $$M$$ from $$M^e\bmod N$$ for random $$M$$). It remains secure (assuming slightly stronger hypothesis) if it's randomness source is stuck.
• ISO/IEC 9796-2 scheme 2. It is a randomized RSA signature scheme with message recovery (that is, with some or all of the message conveyed in the signature itself, saving bandwidth). It has a strong security reduction to the RSA problem. It remains secure (assuming slightly stronger hypothesis) if it's randomness source is stuck.
• ISO/IEC 9796-2 scheme 3. It is a deterministic RSA signature scheme with message recovery, equivalent to scheme 2 above with no randomness, and maximum ability to embed data in the signature (size of the modulus, minus hash width and 2 bytes). It inherits scheme 2's security reduction.
• RSASSA-PKCS1-v1_5 of PKCS#1v2.2. It is a deterministic signature scheme with appendix. There is no known attack against this scheme, but no security reduction.
• ISO/IEC 9796-2 scheme 1, a deterministic RSA signature scheme with message recovery. There is an existential forgery against this scheme when the adversary can obtain signature of chosen messages, thus the (fully compatible) scheme 3 should be used in all new systems.