2
$\begingroup$

Following the RFC 8446 it states that:

RSASSA-PSS RSAE algorithms: Indicates a signature algorithm using RSASSA-PSS [RFC8017] with mask generation function 1. The digest used in the mask generation function and the digest being signed are both the corresponding hash algorithm as defined in [SHS]. The length of the Salt MUST be equal to the length of the output of the digest algorithm. If the public key is carried in an X.509 certificate, it MUST use the rsaEncryption OID [RFC5280].

And from RFC 4055 it's stated that:

The rsaEncryption object identifier continues to identify the subject public key when the RSA private key owner does not wish to limit the use of the public key exclusively to either RSASSA-PSS or RSAES-OAEP. In this case, the rsaEncryption object identifier MUST be used in the algorithm field within the subject public key information, and the parameters field MUST contain NULL.

It got me confused when trying to verify certificate signature, how can I know which algorithm was used if the OID is rsaEncryption and furthermore with what hash? (PSS or not)

Because the params field is NULL, and there's only the OID info, so from where can I derive the relevant information such as signature and hash algorithm with it?

$\endgroup$
3
$\begingroup$

There are two different identifiers in a certificate, the algorithm of the public key for the certificate and the algorithm of the signature from the issuer. The two don't have to even be the same algorithm family (e.g. RSA CA certs can sign ECDSA certs, and vice versa).

In the following certificate parse structure the algorithm identifiers starting at offset 24 and 529 (certificate.tbsCertificate.signature and certificate.signatureAlgorithm) identify that the issuing authority signed the certificate with RSA PKCS#1 with SHA-1 (id-sha1WithRSAEncryption).

The algorithm identifier at offset 371 (certificate.tbsCertificate.subjectPublicKeyInfo.algorithm) identifies that the public key contained within this certificate is an RSA key (id-rsaEncryption).

If the issuing authority had signed the certificate using RSASSA-PSS then the certificate.signatureAlgorithm and certificate.tbcCertificate.signature values would have the RSA-PSS object identifier (1.2.840.113549.1.1.10) and their parameters would convey the PSS data.

$ openssl asn1parse -in rsa384.cer -i
    0:d=0  hl=4 l= 591 cons: SEQUENCE
    4:d=1  hl=4 l= 521 cons:  SEQUENCE
    8:d=2  hl=2 l=   3 cons:   cont [ 0 ]
   10:d=3  hl=2 l=   1 prim:    INTEGER           :02
   13:d=2  hl=2 l=   9 prim:   INTEGER           :C42D621149D3EE63
   24:d=2  hl=2 l=  13 cons:   SEQUENCE
   26:d=3  hl=2 l=   9 prim:    OBJECT            :sha1WithRSAEncryption
   37:d=3  hl=2 l=   0 prim:    NULL
   39:d=2  hl=3 l= 146 cons:   SEQUENCE
   42:d=3  hl=2 l=  11 cons:    SET
   44:d=4  hl=2 l=   9 cons:     SEQUENCE
   46:d=5  hl=2 l=   3 prim:      OBJECT            :countryName
   51:d=5  hl=2 l=   2 prim:      PRINTABLESTRING   :US
   55:d=3  hl=2 l=  19 cons:    SET
   57:d=4  hl=2 l=  17 cons:     SEQUENCE
   59:d=5  hl=2 l=   3 prim:      OBJECT            :stateOrProvinceName
   64:d=5  hl=2 l=  10 prim:      UTF8STRING        :Washington
   76:d=3  hl=2 l=  16 cons:    SET
   78:d=4  hl=2 l=  14 cons:     SEQUENCE
   80:d=5  hl=2 l=   3 prim:      OBJECT            :localityName
   85:d=5  hl=2 l=   7 prim:      UTF8STRING        :Redmond
   94:d=3  hl=2 l=  24 cons:    SET
   96:d=4  hl=2 l=  22 cons:     SEQUENCE
   98:d=5  hl=2 l=   3 prim:      OBJECT            :organizationName
  103:d=5  hl=2 l=  15 prim:      UTF8STRING        :Microsoft Corp.
  120:d=3  hl=2 l=  32 cons:    SET
  122:d=4  hl=2 l=  30 cons:     SEQUENCE
  124:d=5  hl=2 l=   3 prim:      OBJECT            :organizationalUnitName
  129:d=5  hl=2 l=  23 prim:      UTF8STRING        :.NET Framework (CoreFx)
  154:d=3  hl=2 l=  32 cons:    SET
  156:d=4  hl=2 l=  30 cons:     SEQUENCE
  158:d=5  hl=2 l=   3 prim:      OBJECT            :commonName
  163:d=5  hl=2 l=  23 prim:      UTF8STRING        :RSA 384-bit Certificate
  188:d=2  hl=2 l=  30 cons:   SEQUENCE
  190:d=3  hl=2 l=  13 prim:    UTCTIME           :160302165904Z
  205:d=3  hl=2 l=  13 prim:    UTCTIME           :160401165904Z
  220:d=2  hl=3 l= 146 cons:   SEQUENCE
  223:d=3  hl=2 l=  11 cons:    SET
  225:d=4  hl=2 l=   9 cons:     SEQUENCE
  227:d=5  hl=2 l=   3 prim:      OBJECT            :countryName
  232:d=5  hl=2 l=   2 prim:      PRINTABLESTRING   :US
  236:d=3  hl=2 l=  19 cons:    SET
  238:d=4  hl=2 l=  17 cons:     SEQUENCE
  240:d=5  hl=2 l=   3 prim:      OBJECT            :stateOrProvinceName
  245:d=5  hl=2 l=  10 prim:      UTF8STRING        :Washington
  257:d=3  hl=2 l=  16 cons:    SET
  259:d=4  hl=2 l=  14 cons:     SEQUENCE
  261:d=5  hl=2 l=   3 prim:      OBJECT            :localityName
  266:d=5  hl=2 l=   7 prim:      UTF8STRING        :Redmond
  275:d=3  hl=2 l=  24 cons:    SET
  277:d=4  hl=2 l=  22 cons:     SEQUENCE
  279:d=5  hl=2 l=   3 prim:      OBJECT            :organizationName
  284:d=5  hl=2 l=  15 prim:      UTF8STRING        :Microsoft Corp.
  301:d=3  hl=2 l=  32 cons:    SET
  303:d=4  hl=2 l=  30 cons:     SEQUENCE
  305:d=5  hl=2 l=   3 prim:      OBJECT            :organizationalUnitName
  310:d=5  hl=2 l=  23 prim:      UTF8STRING        :.NET Framework (CoreFx)
  335:d=3  hl=2 l=  32 cons:    SET
  337:d=4  hl=2 l=  30 cons:     SEQUENCE
  339:d=5  hl=2 l=   3 prim:      OBJECT            :commonName
  344:d=5  hl=2 l=  23 prim:      UTF8STRING        :RSA 384-bit Certificate
  369:d=2  hl=2 l=  76 cons:   SEQUENCE
  371:d=3  hl=2 l=  13 cons:    SEQUENCE
  373:d=4  hl=2 l=   9 prim:     OBJECT            :rsaEncryption
  384:d=4  hl=2 l=   0 prim:     NULL
  386:d=3  hl=2 l=  59 prim:    BIT STRING
  447:d=2  hl=2 l=  80 cons:   cont [ 3 ]
  449:d=3  hl=2 l=  78 cons:    SEQUENCE
  451:d=4  hl=2 l=  29 cons:     SEQUENCE
  453:d=5  hl=2 l=   3 prim:      OBJECT            :X509v3 Subject Key Identifier
  458:d=5  hl=2 l=  22 prim:      OCTET STRING      [HEX DUMP]:0414E451B61668BCEA124E09FE0A9E36B13865957515
  482:d=4  hl=2 l=  31 cons:     SEQUENCE
  484:d=5  hl=2 l=   3 prim:      OBJECT            :X509v3 Authority Key Identifier
  489:d=5  hl=2 l=  24 prim:      OCTET STRING      [HEX DUMP]:30168014E451B61668BCEA124E09FE0A9E36B13865957515
  515:d=4  hl=2 l=  12 cons:     SEQUENCE
  517:d=5  hl=2 l=   3 prim:      OBJECT            :X509v3 Basic Constraints
  522:d=5  hl=2 l=   5 prim:      OCTET STRING      [HEX DUMP]:30030101FF
  529:d=1  hl=2 l=  13 cons:  SEQUENCE
  531:d=2  hl=2 l=   9 prim:   OBJECT            :sha1WithRSAEncryption
  542:d=2  hl=2 l=   0 prim:   NULL
  544:d=1  hl=2 l=  49 prim:  BIT STRING
$\endgroup$
  • $\begingroup$ The answer is missing the column information. $\endgroup$ – kelalaka Feb 6 at 18:37
  • $\begingroup$ Thank you for the detailed answer! Still having a bit trouble understanding something about the certificate verification when using PSS. If the client offers 'rsa_pss_rsae_*', how can I verify the certificate? Does it mean that it'll be signed with PSS but the public key will be RSA (with OID rsaEncryption)? $\endgroup$ – user65677 Feb 7 at 7:58
  • $\begingroup$ @user65677 Assuming you’re talking about TLS 1.3, I believe you are correct. crypto.stackexchange.com/q/58680/36951 $\endgroup$ – bartonjs Feb 7 at 16:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.