Questions tagged [rsa-pss]

RSA-PSS (officially: RSASSA-PSS) is an RSA signature scheme that is provably reduced to the RSA problem.

Filter by
Sorted by
Tagged with
1
vote
1answer
69 views

On what basis is padding chosen in OpenSSL?

I am using CAPI Engine in OpenSSL and I did some test. When I use TLS 1.0 or 1.1, during handshake and RSA signing, PKCS padding is chosen. When I use TLS 1.2, RSA signing uses PSS padding. What ...
2
votes
1answer
76 views

Are RSA-PSS parameters standardized?

I wish to agree with a 3rd party on using RSA-PSS algorithm for a implementing a Digital Signature Scheme. I want to avoid selection of RSA parameters like salt length, hash algorithm etc at my side ...
1
vote
1answer
116 views

RSA Signing: SHA512 incompatible with PSS?

I am wrapping the RSACng class from the .Net API. Whilst unit testing, I run checks against an array of possibilities: Key Size = 1024, 2048, or 3072 bits Padding ...
3
votes
2answers
273 views

Attack on security model for RSA-FDH

I recently read in Cryptography textbooks and online videos that compared to Textbook RSA which is insecure against Chosen Plaintext Attacks (CPA) and Chosen Ciphertext Attacks (CCA), RSA-FDH is ...
6
votes
3answers
2k views

Why does OpenSSL differentiate between PSS and non-PSS for private key generation?

RSA-PSS private keys The following command will generate an RSA-PSS private key: ...
2
votes
2answers
4k views

What is the difference between RSASSA-PSS signing and RSA-PSS signing?

I read the RFC 8017 and understood the pkcsv1.5 and pss padding techniques. I understood that in RSASSA-PSS signing scheme the signature will be appended at the end of M. In some websites I read both ...
1
vote
1answer
85 views

How reasonable is deriving the key a corpus of RSA-PSS signed messages?

Given access to a 2048 bit public key, a large corpus of 2048 bit plain text messages and their signatures (RSA-PSS with SHA256 as the hash and MGF) are any of the following statements correct: ...
0
votes
1answer
245 views

How can I verify certificate signature algorithm in TLS 1.3 using PSS?

I've read this post but I'm still unable to understand some things. I'm trying to verify that the signature algorithm used in the certificate matches the proposed list from the client. (As it's ...
2
votes
1answer
625 views

How to identify RSASSA-PSS from rsaEncryption OID?

Following the RFC 8446 it states that: RSASSA-PSS RSAE algorithms: Indicates a signature algorithm using RSASSA-PSS [RFC8017] with mask generation function 1. The digest used in ...
6
votes
1answer
574 views

RSA PSS security advantage

To my humble opinion, please correct me if I'm wrong, RSA-PSS (PKCS#1 ver 2.1) advantage over RSA as described in PKCS#1 ver. 1.5 is in its security proofs. Does this proof and the advantage is still ...
10
votes
2answers
3k views

What's the difference between rsa_pss_pss_* and rsa_pss_rsae_* schemes?

I'm trying to understand the difference between rsa_pss_pss_ and rsa_pss_rsae_. The picture shows the extension of TLS1.3's ...
2
votes
2answers
5k views

Can someone explain RSA-PSS to me?

I can't find any usable resources about it online (at least ones that make sense to me right now), so any links to articles or if you could explain it to me would be greatly appreciated. What I don't ...
3
votes
0answers
519 views

How to determine the correct padding to use for rsa signing?

Before today I didn't know the difference between RSA padding for encryption and for signing, I think this answer describes it pretty succinctly, however, I don't know if there is an optimal padding ...
-1
votes
1answer
121 views

Is it possible to generate random bits to be imported as a private key and then deducing his public key?

Is it possible to generate random bits (or any bits we decide) to be imported as a private key and then deducting his public key please? Ideally with a supported Javascript WebCrypto algorithm ( ...
2
votes
1answer
590 views

Security of RSA signature using PKCS 1.5

I'm using mbedTLS to generate RSA signatures, and using PKCS 1.5 I get consistent signature output. I wanted to ask/confirm here that this is secure? There's surely got to be a reason for the PSS ...
3
votes
2answers
740 views

Why does PSS produce an EM message that's almost as long as the modulus?

I try to understand the reasons behind the design of PSS scheme for RSA. Why is the length of the EM message (that is, the result of PSS transformation just before signing) equals approximately to the ...
2
votes
1answer
769 views

Could someone please explain test vectors of NIST for RSASSA-PSS 1024 bit?

I am new to RSASSA-PSS Signature verification algorithm. Below are the test vectors from NIST but i am not able to understand each parameter. I could understand that SHA1 is used for Hashing and e ...
2
votes
1answer
830 views

which exponent to be used for RSA e =3 or 65537 for RSASSAPSS signature verification

I have the public key and I dont know how to obtain Modulus and exponent. After referring stack overflow, I have used below command line to obtain e and M finally as mentioned below. openssl.exe rsa -...
9
votes
1answer
11k views

Should I be using PKCS1 v1.5 or PSS for RSA signatures?

I am implementing an application where a user needs to sign some data that they have created, store it in an untrusted place, then later retrieve that data and verify it is still authentic before ...
1
vote
1answer
450 views

Zero byte header in RSA-OAEP vs. RSA-PSS

PKCS#1 v2.1/RFC3437 defines the OAEP padding mode for encryption and the PSS for signature padding. Both schemes are based on the generic constructions not specifically tailored to RSA by Rogaway &...
4
votes
1answer
2k views

What are I2OSP & OS2IP in RSA PKCS#1?

I started working with RSA two weeks ago. But I couldn't really understand how exactly I2OSP & OS2IP are working. I am using some open source for signature verification through RSA PSS algorithm. ...
2
votes
0answers
2k views

How to generate an RSASSA-PSS signature with MGF1-SHA256? [closed]

As part of rooting a device, I need to generate a 256-byte RSASSA-PSS signature using SHA256 as the hash and MGF1-SHA256 as the mask function, for an update file I created. I can choose any 32-byte ...
6
votes
1answer
467 views

Can RSA-PSS signing be made deterministic without loss of security?

Is it possible to make RSA-PSS signing deterministic without loss of security? Specifically, I would use Blake2b of the key and message to generate the salt.
13
votes
3answers
15k views

Is RSASSA-PKCS1-v1_5 a good signature scheme for new systems?

Is RSASSA-PKCS1-v1_5 a good signature scheme to recommend that people use in new systems? Is it believed to be secure and represent the state-of-the-art in RSA-based signatures? I understand that ...
11
votes
1answer
10k views

RSA-PSS salt size

One of the inputs of RSA-PSS signing and verification is the salt size. According to PKCS#1, you must know the salt size before the verification is carried out. However, this makes interoperability ...