Questions tagged [rsa-pss]

RSA-PSS (officially: RSASSA-PSS) is an RSA signature scheme that is provably reduced to the RSA problem.

Filter by
Sorted by
Tagged with
0 votes
2 answers
192 views

sign a JWT with RS256 using a RSA-PSS SHA256 key pair?

Given a private key using algorithm RSA-PSS with SHA256 is it possible to use this key to sign a JWT using algorith RS256 (RSA with SHA256) instead of PS256 (RSA-PSS with SHA256)? The German ...
Basti's user avatar
  • 103
3 votes
1 answer
240 views

Implications of switching RSA padding schemes

In my company we want to switch from PKCSv1.5 to PSS for RSA signing. This is because of the marvin attack vector. My question is, if an adversary can see many similar messages that were signed with ...
whomaniac's user avatar
  • 133
4 votes
1 answer
93 views

Is Bypassing Padding Verification in RSA-PSS Dangerous?

I am currently working on a project involving RSA-PSS (Probabilistic Signature Scheme) for digital signatures. While researching potential vulnerabilities, I came across the well-known Bleichenbacher ...
user113612's user avatar
0 votes
0 answers
508 views

How to create RSASSA-PSS keys using openssl?

I am trying to understand the RSASSA-PSS and process of generating keys with rsassaPss. I am using below ...
Preeti 's user avatar
  • 109
2 votes
1 answer
96 views

May RSA-PSS DB MSB be 1?

I've used OpenSSL to generate an RSA-PSS keypair. ...
Clara Höfner's user avatar
7 votes
2 answers
637 views

Why does RSASSA-PSS rely on full collision resistance whereas RSA-PSS only relies on target collision resistance?

This is sort-of a reply to the top answer given to this question, which states that whereas RSA-PSS, defined in terms of $H(r \ || \ M)$, only relies on target collision resistance and is secure even ...
whatf0xx's user avatar
  • 203
1 vote
1 answer
731 views

Create RSA Public/Private Keys with OID rsassaPss

I'd like to create a public/private RSA key pair where the OID of both keys is rsassaPss. I can create the private key fine but when I extract the public key I ...
Christopher King's user avatar
3 votes
3 answers
912 views

Is there an easy way to make textbook RSA secure enough so it can be used in real life?

I have written a raw (textbook) RSA implementation (just for fun) and I wonder is there an easy way to make it secure enough so it can be used in real life (without implementing OAEP+ and RSASSA-PSS)? ...
Brongs Gaming's user avatar
0 votes
1 answer
428 views

RSA DECRYPTION when N gives only one prime number

I am getting only 1 prime factor to some power if i factorize N for RSA decryption. So, in this case what will be the value of P and Q. P will be that one Prime Factor and then there is nothing left ...
Anonymous's user avatar
1 vote
1 answer
259 views

What salt should be used when generating TLS 1.3 CertificateVerify message?

When signing handshake messages digest, the MGF1 function takes some salt value with same length as the digest has. But what content must be in salt's buffer? I explored the source code of libnettle, ...
Iceman's user avatar
  • 137
2 votes
1 answer
851 views

PKCS#1: Purpose of `Padding1` in EMSA-PSS encoding method

The central part of the RSASSA-PSS signature scheme of PKCS#1 is the EMSA-PSS encoding operation, described in section 9.1 of ...
Morrolan's user avatar
  • 1,147
5 votes
1 answer
2k views

RSASSA-PSS in TLS 1.2

I know it is possible to use RSASSA-PKCS1-v1_5 with client certificates in TLS 1.3. But what about the other way around: using RSASSA-PSS with client certificates in TLS 1.2? Is it possible to use ...
phips's user avatar
  • 53
3 votes
0 answers
46 views

Security of receiving RSA-PSS computed mask in verification step

I'm trying to verify an RSA-PSS padding in an Ethereum smart contract The code to compute the MGF step (i.e. calculating many SHA1 hashes) is very expensive in terms of computation costs (gas) on ...
Hadar Rottenberg's user avatar
1 vote
0 answers
215 views

Exploiting weak hash functions in RSA-PSS

I'm just trying to understand how a Weak/broken hash can break RSA-PSS or any other signature/encryption that uses it. I know you can forge another message that has the same hash but that message ...
Ahmad Wahbi's user avatar
3 votes
1 answer
2k views

On what basis is padding chosen in OpenSSL?

I am using CAPI Engine in OpenSSL and I did some test. When I use TLS 1.0 or 1.1, during handshake and RSA signing, PKCS padding is chosen. When I use TLS 1.2, RSA signing uses PSS padding. What ...
archangel's user avatar
4 votes
1 answer
1k views

Are RSA-PSS parameters standardized?

I wish to agree with a 3rd party on using RSA-PSS algorithm for a implementing a Digital Signature Scheme. I want to avoid selection of RSA parameters like salt length, hash algorithm etc at my side ...
user76827's user avatar
1 vote
1 answer
2k views

RSA Signing: SHA512 incompatible with PSS?

I am wrapping the RSACng class from the .Net API. Whilst unit testing, I run checks against an array of possibilities: Key Size = 1024, 2048, or 3072 bits Padding ...
Ama's user avatar
  • 113
3 votes
2 answers
1k views

Attack on security model for RSA-FDH

I recently read in Cryptography textbooks and online videos that compared to Textbook RSA which is insecure against Chosen Plaintext Attacks (CPA) and Chosen Ciphertext Attacks (CCA), RSA-FDH is ...
user71221's user avatar
9 votes
3 answers
6k views

Why does OpenSSL differentiate between PSS and non-PSS for private key generation?

RSA-PSS private keys The following command will generate an RSA-PSS private key: ...
neubert's user avatar
  • 2,927
10 votes
2 answers
20k views

What is the difference between RSASSA-PSS signing and RSA-PSS signing?

I read the RFC 8017 and understood the pkcsv1.5 and pss padding techniques. I understood that in RSASSA-PSS signing scheme the signature will be appended at the end of M. In some websites I read both ...
sg777's user avatar
  • 367
1 vote
1 answer
242 views

How reasonable is deriving the key a corpus of RSA-PSS signed messages?

Given access to a 2048 bit public key, a large corpus of 2048 bit plain text messages and their signatures (RSA-PSS with SHA256 as the hash and MGF) are any of the following statements correct: ...
Joshka's user avatar
  • 113
0 votes
1 answer
842 views

How can I verify certificate signature algorithm in TLS 1.3 using PSS?

I've read this post but I'm still unable to understand some things. I'm trying to verify that the signature algorithm used in the certificate matches the proposed list from the client. (As it's ...
Martin's user avatar
  • 165
3 votes
1 answer
2k views

How to identify RSASSA-PSS from rsaEncryption OID?

Following the RFC 8446 it states that: RSASSA-PSS RSAE algorithms: Indicates a signature algorithm using RSASSA-PSS [RFC8017] with mask generation function 1. The digest used in the mask generation ...
user65677's user avatar
6 votes
1 answer
1k views

RSA PSS security advantage

To my humble opinion, please correct me if I'm wrong, RSA-PSS (PKCS#1 ver 2.1) advantage over RSA as described in PKCS#1 ver. 1.5 is in its security proofs. Does this proof and the advantage is still ...
Evgeni Vaknin's user avatar
14 votes
2 answers
11k views

What's the difference between rsa_pss_pss_* and rsa_pss_rsae_* schemes?

I'm trying to understand the difference between rsa_pss_pss_ and rsa_pss_rsae_. The picture shows the extension of TLS1.3's ...
Nail Jay's user avatar
  • 317
11 votes
3 answers
20k views

What is RSA-PSS and how is it different from a hash?

I can't find any usable resources about it online (at least ones that make sense to me right now), so any links to articles or if you could explain it to me would be greatly appreciated. What I don't ...
lougehrig10's user avatar
3 votes
0 answers
797 views

How to determine the correct padding to use for rsa signing?

Before today I didn't know the difference between RSA padding for encryption and for signing, I think this answer describes it pretty succinctly, however, I don't know if there is an optimal padding ...
Daniel V's user avatar
  • 131
-1 votes
1 answer
143 views

Is it possible to generate random bits to be imported as a private key and then deducing his public key?

Is it possible to generate random bits (or any bits we decide) to be imported as a private key and then deducting his public key please? Ideally with a supported Javascript WebCrypto algorithm ( ...
lakano's user avatar
  • 51
2 votes
1 answer
1k views

Security of RSA signature using PKCS 1.5

I'm using mbedTLS to generate RSA signatures, and using PKCS 1.5 I get consistent signature output. I wanted to ask/confirm here that this is secure? There's surely got to be a reason for the PSS ...
Dave P's user avatar
  • 23
4 votes
2 answers
2k views

Why does PSS produce an EM message that's almost as long as the modulus?

I try to understand the reasons behind the design of PSS scheme for RSA. Why is the length of the EM message (that is, the result of PSS transformation just before signing) equals approximately to the ...
Dingo13's user avatar
  • 2,867
2 votes
1 answer
1k views

Could someone please explain test vectors of NIST for RSASSA-PSS 1024 bit?

I am new to RSASSA-PSS Signature verification algorithm. Below are the test vectors from NIST but i am not able to understand each parameter. I could understand that SHA1 is used for Hashing and e ...
danny's user avatar
  • 253
2 votes
1 answer
2k views

which exponent to be used for RSA e =3 or 65537 for RSASSAPSS signature verification

I have the public key and I dont know how to obtain Modulus and exponent. After referring stack overflow, I have used below command line to obtain e and M finally as mentioned below. openssl.exe rsa -...
danny's user avatar
  • 253
15 votes
1 answer
25k views

Should I be using PKCS1 v1.5 or PSS for RSA signatures?

I am implementing an application where a user needs to sign some data that they have created, store it in an untrusted place, then later retrieve that data and verify it is still authentic before ...
izzle's user avatar
  • 591
2 votes
1 answer
677 views

Zero byte header in RSA-OAEP vs. RSA-PSS

PKCS#1 v2.1/RFC3437 defines the OAEP padding mode for encryption and the PSS for signature padding. Both schemes are based on the generic constructions not specifically tailored to RSA by Rogaway &...
mat's user avatar
  • 2,528
4 votes
1 answer
6k views

What are I2OSP & OS2IP in RSA PKCS#1?

I started working with RSA two weeks ago. But I couldn't really understand how exactly I2OSP & OS2IP are working. I am using some open source for signature verification through RSA PSS algorithm. ...
yellanki bhuvan's user avatar
2 votes
0 answers
3k views

How to generate an RSASSA-PSS signature with MGF1-SHA256? [closed]

As part of rooting a device, I need to generate a 256-byte RSASSA-PSS signature using SHA256 as the hash and MGF1-SHA256 as the mask function, for an update file I created. I can choose any 32-byte ...
Alex's user avatar
  • 129
6 votes
1 answer
761 views

Can RSA-PSS signing be made deterministic without loss of security?

Is it possible to make RSA-PSS signing deterministic without loss of security? Specifically, I would use Blake2b of the key and message to generate the salt.
Demi's user avatar
  • 4,793
21 votes
3 answers
25k views

Is RSASSA-PKCS1-v1_5 a good signature scheme for new systems?

Is RSASSA-PKCS1-v1_5 a good signature scheme to recommend that people use in new systems? Is it believed to be secure and represent the state-of-the-art in RSA-based signatures? I understand that RSA-...
D.W.'s user avatar
  • 36.4k
14 votes
1 answer
16k views

RSA-PSS salt size

One of the inputs of RSA-PSS signing and verification is the salt size. According to PKCS#1, you must know the salt size before the verification is carried out. However, this makes interoperability ...
Conrado's user avatar
  • 6,434