In the RSASSA-PKCS-v1_5 signature scheme, the first step is to perform an encoding on the hashed data. (0x00||0x01||PS||0x00||T).
Is this encoding important for security ? What happens if the hash is directly encrypted without encoding ?
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.Sign up to join this community
As per section 9 of the paper, the encoding used is required for the security of the scheme.
The encoding operation may introduce some randomness, so that different applications of the encoding operation to the same message will produce different encoded messages, which has benefits for provable security. For such an encoding method, both an encoding and a verification operation are needed unless the verifier can reproduce the randomness (e.g., by obtaining the salt value from the signer). For a deterministic encoding method only an encoding operation is needed.
Two encoding methods for signatures with appendix are employed in the signature schemes and are specified here: EMSA-PSS and EMSA-PKCS1- v1_5.
The paper then goes into further detail on these two encoding methods.
You would be compromising the security proof of the scheme if you did not use the encoding, however you could feasibly apply the encoding after hashing the message. Per the paper:
Without compromising the security proof for RSASSA-PSS, one may perform steps 1 and 2 of EMSA-PSS-ENCODE and EMSA-PSS-VERIFY (the application of the hash function to the message) outside the module that computes the rest of the signature operation, so that mHash rather than the message M itself is input to the module. In other words, the security proof for RSASSA-PSS still holds even if an opponent can control the value of mHash.
The fabulous answer here goes into detail regarding one attack the encoding prevents, and provides links to other attacks on wide deterministic RSA signature signature schemes.
Section 2 of the original paper by Bellare & Rogaway outlines several advantages of the encoding scheme.