When using RSA-PKCS#1v1.5 to sign and verify a message-digest, is there a compulsory relation between the sizes of message-digest and the key/signature ? For example, If I use key/signature length of 3072 bits, do I have to use message-digest of 384 bits (like SHA-384), or 256 bits (SHA-256) is sufficient ?

  • 1
    $\begingroup$ The only compulsory relationship is that the hash plus encoding (ASN.1) and padding fit in the RSA modulus, which is easy for currently used RSA and hash sizes. However, the overall strength is the strength of the RSA primitive or the hash whichever is LESS. RSA-3072 and SHA-256 both have strength about 128 bits making them a good match. Using SHA-384 may do extra work for no benefit.; however, because SHA-384 uses 1024-bit input 'chunks' where SHA-256 uses 512-bit, especially for large messages on 64-bit processors, SHA-384 may actually be cheaper. $\endgroup$ – dave_thompson_085 Mar 25 at 2:06
  • $\begingroup$ Thank you @dave-thompson-085. Could you please make convert your comment to an answer ? Thanks again. $\endgroup$ – alonco Mar 25 at 15:55
  • $\begingroup$ It's worth to mention that although both RSA-3072 and SHA-256 have the same security strength (of 128 bits), CNSA documents suggest the use of SHA-384. for example: CNSA-algorithm-suite-factsheet $\endgroup$ – alonco Apr 2 at 8:10
  • $\begingroup$ Right; that's part of their recent 'fear-quantum' strategy. They expect current pubkey to fall entirely and be replaced by something radically different, while symmetric can just be expanded modestly (AES-256 and SHA-384). It isn't really needed now, but doing it now is believed to position/prepare you better for the future at little or no cost. $\endgroup$ – dave_thompson_085 Apr 3 at 10:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.