We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [rsa-pss]

RSA-PSS (officially: RSASSA-PSS) is an RSA signature scheme that is provably reduced to the RSA problem.

Filter by
Sorted by
Tagged with
3
votes
2answers
118 views

Attack on security model for RSA-FDH

I recently read in Cryptography textbooks and online videos that compared to Textbook RSA which is insecure against Chosen Plaintext Attacks (CPA) and Chosen Ciphertext Attacks (CCA), RSA-FDH is ...
5
votes
3answers
1k views

Why does OpenSSL differentiate between PSS and non-PSS for private key generation?

RSA-PSS private keys The following command will generate an RSA-PSS private key: ...
1
vote
2answers
2k views

What is the difference between RSASSA-PSS signing and RSA-PSS signing?

I read the RFC 8017 and understood the pkcsv1.5 and pss padding techniques. I understood that in RSASSA-PSS signing scheme the signature will be appended at the end of M. In some websites I read both ...
1
vote
1answer
76 views

How reasonable is deriving the key a corpus of RSA-PSS signed messages?

Given access to a 2048 bit public key, a large corpus of 2048 bit plain text messages and their signatures (RSA-PSS with SHA256 as the hash and MGF) are any of the following statements correct: ...
0
votes
1answer
132 views

How can I verify certificate signature algorithm in TLS 1.3 using PSS?

I've read this post but I'm still unable to understand some things. I'm trying to verify that the signature algorithm used in the certificate matches the proposed list from the client. (As it's ...
2
votes
1answer
399 views

How to identify RSASSA-PSS from rsaEncryption OID?

Following the RFC 8446 it states that: RSASSA-PSS RSAE algorithms: Indicates a signature algorithm using RSASSA-PSS [RFC8017] with mask generation function 1. The digest used in ...
6
votes
1answer
452 views

RSA PSS security advantage

To my humble opinion, please correct me if I'm wrong, RSA-PSS (PKCS#1 ver 2.1) advantage over RSA as described in PKCS#1 ver. 1.5 is in its security proofs. Does this proof and the advantage is still ...
8
votes
2answers
2k views

What's the difference between rsa_pss_pss_* and rsa_pss_rsae_* schemes?

I'm trying to understand the difference between rsa_pss_pss_ and rsa_pss_rsae_. The picture shows the extension of TLS1.3's ...
2
votes
2answers
3k views

Can someone explain RSA-PSS to me?

I can't find any usable resources about it online (at least ones that make sense to me right now), so any links to articles or if you could explain it to me would be greatly appreciated. What I don't ...
3
votes
0answers
440 views

How to determine the correct padding to use for rsa signing?

Before today I didn't know the difference between RSA padding for encryption and for signing, I think this answer describes it pretty succinctly, however, I don't know if there is an optimal padding ...
-1
votes
1answer
117 views

Is it possible to generate random bits to be imported as a private key and then deducing his public key?

Is it possible to generate random bits (or any bits we decide) to be imported as a private key and then deducting his public key please? Ideally with a supported Javascript WebCrypto algorithm ( ...
2
votes
1answer
507 views

Security of RSA signature using PKCS 1.5

I'm using mbedTLS to generate RSA signatures, and using PKCS 1.5 I get consistent signature output. I wanted to ask/confirm here that this is secure? There's surely got to be a reason for the PSS ...
3
votes
2answers
589 views

Why does PSS produce an EM message that's almost as long as the modulus?

I try to understand the reasons behind the design of PSS scheme for RSA. Why is the length of the EM message (that is, the result of PSS transformation just before signing) equals approximately to the ...
2
votes
1answer
671 views

Could someone please explain test vectors of NIST for RSASSA-PSS 1024 bit?

I am new to RSASSA-PSS Signature verification algorithm. Below are the test vectors from NIST but i am not able to understand each parameter. I could understand that SHA1 is used for Hashing and e ...
2
votes
1answer
645 views

which exponent to be used for RSA e =3 or 65537 for RSASSAPSS signature verification

I have the public key and I dont know how to obtain Modulus and exponent. After referring stack overflow, I have used below command line to obtain e and M finally as mentioned below. openssl.exe rsa -...
6
votes
1answer
9k views

Should I be using PKCS1 v1.5 or PSS for RSA signatures?

I am implementing an application where a user needs to sign some data that they have created, store it in an untrusted place, then later retrieve that data and verify it is still authentic before ...
1
vote
1answer
422 views

Zero byte header in RSA-OAEP vs. RSA-PSS

PKCS#1 v2.1/RFC3437 defines the OAEP padding mode for encryption and the PSS for signature padding. Both schemes are based on the generic constructions not specifically tailored to RSA by Rogaway &...
4
votes
1answer
2k views

What are I2OSP & OS2IP in RSA PKCS#1?

I started working with RSA two weeks ago. But I couldn't really understand how exactly I2OSP & OS2IP are working. I am using some open source for signature verification through RSA PSS algorithm. ...
2
votes
0answers
2k views

How to generate an RSASSA-PSS signature with MGF1-SHA256? [closed]

As part of rooting a device, I need to generate a 256-byte RSASSA-PSS signature using SHA256 as the hash and MGF1-SHA256 as the mask function, for an update file I created. I can choose any 32-byte ...
6
votes
1answer
416 views

Can RSA-PSS signing be made deterministic without loss of security?

Is it possible to make RSA-PSS signing deterministic without loss of security? Specifically, I would use Blake2b of the key and message to generate the salt.