For a signing scheme involving generating a $256$ bit digest using SHA256 followed by RSA with $2048$ bit modulus, the signature would always be 256 bit without padding even though signatures of up to $2048$ bits are allowed in the RSA scheme that follows.
As such, is there a need to pad the $256$ bit digest to improve security?
$\begingroup$
$\endgroup$
0
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
For a signing scheme involving generating a 256-bit digest using SHA-256 followed by RSA with 2048-bit modulus, the signature would always be 256-bit without padding..
That assertion is wrong. For every RSA signature scheme, the signature is always at least as wide as the modulus (or next to that; there are tricks to reduce it by a few bits). Much shorter signatures are not verifiable.
Is there a need to pad the 256-bit digest to improve security?
If the question asks whether a more elaborate padding scheme than signing message $M$ as $(\operatorname{SHA-256}(M))^d\bmod N$ is needed: Yes. Otherwise, an existential forgery might be possible per a variant of the Desmedt and Odlyzko attack; it is feasible at least for a 200-bit hash.
Common RSA signature schemes:
- RSASSA-PSS of PKCS#1v2.2. It is a randomized RSA signature scheme with appendix (that is, with the signature appended to the unmodified message). It has a strong security reduction to the RSA problem (finding $M$ from $M^e\bmod N$ for random $M$). It remains secure (assuming slightly stronger hypothesis) if it's randomness source is stuck.
- ISO/IEC 9796-2 scheme 2. It is a randomized RSA signature scheme with message recovery (that is, with some or all of the message conveyed in the signature itself, saving bandwidth). It has a strong security reduction to the RSA problem. It remains secure (assuming slightly stronger hypothesis) if it's randomness source is stuck.
- ISO/IEC 9796-2 scheme 3. It is a deterministic RSA signature scheme with message recovery, equivalent to scheme 2 above with no randomness, and maximum ability to embed data in the signature (size of the modulus, minus hash width and 2 bytes). It inherits scheme 2's security reduction.
- RSASSA-PKCS1-v1_5 of PKCS#1v2.2. It is a deterministic signature scheme with appendix. There is no known attack against this scheme, but no security reduction.
- ISO/IEC 9796-2 scheme 1, a deterministic RSA signature scheme with message recovery. There is an existential forgery against this scheme when the adversary can obtain signature of chosen messages, thus the (fully compatible) scheme 3 should be used in all new systems.
