For the spare-time project I had been working on, I'm evaluating the PKCS#1 padded RSA schemes for implementation.
For PKCS#1 v1.5, encryption doesn't seem to require a hash function, and the signature doesn't need additional mask-generating function (MGF) beyond a digest algorithm for hashing the message.
For PKCS#1 v2.x, both encryption and signature are instantiated with a MGF, a hash function, and an optional label (which has no specified use currently). The MGF which, in turn, is instantiated with another hash function using the (ad hoc) MGF1 construction.
In my opinion, a composite cryptosystem should have as few instantiation parameters as possible, so as to ease implementation burdon and promote interoperability; only parameters necessary for cryptographic agility should be inserted into the design.
Which is why, it comes to me as a suprise, that the hash that instantiates the MGF can be different from that used for hashing the input.
My question here are:
- are there existing recommendations (e.g. CMS, PKIX) on the use and instantiation of PKCS#1 v2.x RSAES-OAEP and RSASSA-PSS, where the selection of hash functions are specified?
- Are there assigned IDs (from IANA or similar organizations)?
- Additional points goes to treatment of NIST Draft FIPS 186-5, where SHAKE-{128,256} are to be approved for use as MGF.