Questions tagged [rsa-pss]
RSA-PSS (officially: RSASSA-PSS) is an RSA signature scheme that is provably reduced to the RSA problem.
36
questions
0
votes
0
answers
74
views
How to create RSASSA-PSS keys using openssl?
I am trying to understand the RSASSA-PSS and process of generating keys with rsassaPss. I am using below ...
- 109
2
votes
1
answer
73
views
7
votes
2
answers
594
views
Why does RSASSA-PSS rely on full collision resistance whereas RSA-PSS only relies on target collision resistance?
This is sort-of a reply to the top answer given to this question, which states that whereas RSA-PSS, defined in terms of $H(r \ || \ M)$, only relies on target collision resistance and is secure even ...
- 103
1
vote
1
answer
470
views
Create RSA Public/Private Keys with OID rsassaPss
I'd like to create a public/private RSA key pair where the OID of both keys is rsassaPss. I can create the private key fine but when I extract the public key I ...
- 121
3
votes
3
answers
843
views
Is there an easy way to make textbook RSA secure enough so it can be used in real life?
I have written a raw (textbook) RSA implementation (just for fun) and I wonder is there an easy way to make it secure enough so it can be used in real life (without implementing OAEP+ and RSASSA-PSS)? ...
0
votes
1
answer
356
views
RSA DECRYPTION when N gives only one prime number
I am getting only 1 prime factor to some power if i factorize N for RSA decryption. So, in this case what will be the value of P and Q. P will be that one Prime Factor and then there is nothing left ...
- 11
1
vote
1
answer
220
views
What salt should be used when generating TLS 1.3 CertificateVerify message?
When signing handshake messages digest, the MGF1 function takes some salt value with same length as the digest has. But what content must be in salt's buffer?
I explored the source code of libnettle, ...
- 137
2
votes
1
answer
723
views
PKCS#1: Purpose of `Padding1` in EMSA-PSS encoding method
The central part of the RSASSA-PSS signature scheme of PKCS#1 is the EMSA-PSS encoding operation, described in section 9.1 of ...
- 1,082
5
votes
1
answer
2k
views
RSASSA-PSS in TLS 1.2
I know it is possible to use RSASSA-PKCS1-v1_5 with client certificates in TLS 1.3.
But what about the other way around: using RSASSA-PSS with client certificates in TLS 1.2?
Is it possible to use ...
- 53
3
votes
0
answers
45
views
Security of receiving RSA-PSS computed mask in verification step
I'm trying to verify an RSA-PSS padding in an Ethereum smart contract
The code to compute the MGF step (i.e. calculating many SHA1 hashes) is very expensive in terms of computation costs (gas) on ...
1
vote
0
answers
199
views
Exploiting weak hash functions in RSA-PSS
I'm just trying to understand how a Weak/broken hash can break RSA-PSS or any other signature/encryption that uses it.
I know you can forge another message that has the same hash but that message ...
- 21
3
votes
1
answer
2k
views
On what basis is padding chosen in OpenSSL?
I am using CAPI Engine in OpenSSL and I did some test. When I use TLS 1.0 or 1.1, during handshake and RSA signing, PKCS padding is chosen. When I use TLS 1.2, RSA signing uses PSS padding.
What ...
- 31
4
votes
1
answer
1k
views
Are RSA-PSS parameters standardized?
I wish to agree with a 3rd party on using RSA-PSS algorithm for a implementing a Digital Signature Scheme. I want to avoid selection of RSA parameters like salt length, hash algorithm etc at my side ...
- 41
1
vote
1
answer
2k
views
RSA Signing: SHA512 incompatible with PSS?
I am wrapping the RSACng class from the .Net API.
Whilst unit testing, I run checks against an array of possibilities:
Key Size = 1024, 2048, or 3072 bits
Padding ...
- 113
3
votes
2
answers
957
views
Attack on security model for RSA-FDH
I recently read in Cryptography textbooks and online videos that compared to Textbook RSA which is insecure against Chosen
Plaintext Attacks (CPA) and Chosen Ciphertext Attacks (CCA), RSA-FDH is ...
- 31
9
votes
3
answers
6k
views
Why does OpenSSL differentiate between PSS and non-PSS for private key generation?
RSA-PSS private keys
The following command will generate an RSA-PSS private key:
...
- 2,895
9
votes
2
answers
19k
views
What is the difference between RSASSA-PSS signing and RSA-PSS signing?
I read the RFC 8017 and understood the pkcsv1.5 and pss padding techniques. I understood that in RSASSA-PSS signing scheme the signature will be appended at the end of M.
In some websites I read both ...
- 357
1
vote
1
answer
225
views
How reasonable is deriving the key a corpus of RSA-PSS signed messages?
Given access to a 2048 bit public key, a large corpus of 2048 bit plain text messages and their signatures (RSA-PSS with SHA256 as the hash and MGF) are any of the following statements correct:
...
- 113
0
votes
1
answer
768
views
How can I verify certificate signature algorithm in TLS 1.3 using PSS?
I've read this post but I'm still unable to understand some things.
I'm trying to verify that the signature algorithm used in the certificate matches the proposed list from the client. (As it's ...
- 165
3
votes
1
answer
2k
views
How to identify RSASSA-PSS from rsaEncryption OID?
Following the RFC 8446 it states that:
RSASSA-PSS RSAE algorithms: Indicates a signature algorithm using
RSASSA-PSS [RFC8017] with mask generation function 1. The digest
used in the mask generation ...
- 65
6
votes
1
answer
1k
views
RSA PSS security advantage
To my humble opinion, please correct me if I'm wrong, RSA-PSS (PKCS#1 ver 2.1) advantage over RSA as described in PKCS#1 ver. 1.5 is in its security proofs. Does this proof and the advantage is still ...
- 1,066
13
votes
2
answers
10k
views
What's the difference between rsa_pss_pss_* and rsa_pss_rsae_* schemes?
I'm trying to understand the difference between rsa_pss_pss_ and rsa_pss_rsae_.
The picture shows the extension of TLS1.3's ...
- 307
10
votes
3
answers
18k
views
What is RSA-PSS and how is it different from a hash?
I can't find any usable resources about it online (at least ones that make sense to me right now), so any links to articles or if you could explain it to me would be greatly appreciated.
What I don't ...
- 113
3
votes
0
answers
780
views
How to determine the correct padding to use for rsa signing?
Before today I didn't know the difference between RSA padding for encryption and for signing, I think this answer describes it pretty succinctly, however, I don't know if there is an optimal padding ...
- 131
-1
votes
1
answer
140
views
Is it possible to generate random bits to be imported as a private key and then deducing his public key?
Is it possible to generate random bits (or any bits we decide) to be imported as a private key and then deducting his public key please?
Ideally with a supported Javascript WebCrypto algorithm ( ...
- 51
2
votes
1
answer
927
views
Security of RSA signature using PKCS 1.5
I'm using mbedTLS to generate RSA signatures, and using PKCS 1.5 I get consistent signature output.
I wanted to ask/confirm here that this is secure? There's surely got to be a reason for the PSS ...
- 23
4
votes
2
answers
2k
views
Why does PSS produce an EM message that's almost as long as the modulus?
I try to understand the reasons behind the design of PSS scheme for RSA. Why is the length of the EM message (that is, the result of PSS transformation just before signing) equals approximately to the ...
- 2,837
2
votes
1
answer
1k
views
Could someone please explain test vectors of NIST for RSASSA-PSS 1024 bit?
I am new to RSASSA-PSS Signature verification algorithm. Below are the test vectors from NIST but i am not able to understand each parameter.
I could understand that SHA1 is used for Hashing and e ...
- 253
2
votes
1
answer
2k
views
which exponent to be used for RSA e =3 or 65537 for RSASSAPSS signature verification
I have the public key and I dont know how to obtain Modulus and exponent. After referring stack overflow, I have used below command line to obtain e and M finally as mentioned below.
openssl.exe rsa -...
- 253
15
votes
1
answer
24k
views
Should I be using PKCS1 v1.5 or PSS for RSA signatures?
I am implementing an application where a user needs to sign some data that they have created, store it in an untrusted place, then later retrieve that data and verify it is still authentic before ...
- 581
2
votes
1
answer
654
views
Zero byte header in RSA-OAEP vs. RSA-PSS
PKCS#1 v2.1/RFC3437 defines the OAEP padding mode for encryption and the PSS for signature padding. Both schemes are based on the generic constructions not specifically tailored to RSA by Rogaway &...
- 2,508
4
votes
1
answer
5k
views
What are I2OSP & OS2IP in RSA PKCS#1?
I started working with RSA two weeks ago. But I couldn't really understand how exactly I2OSP & OS2IP are working. I am using some open source for signature verification through RSA PSS algorithm.
...
2
votes
0
answers
3k
views
How to generate an RSASSA-PSS signature with MGF1-SHA256? [closed]
As part of rooting a device, I need to generate a 256-byte RSASSA-PSS signature using SHA256 as the hash and MGF1-SHA256 as the mask function, for an update file I created. I can choose any 32-byte ...
- 129
6
votes
1
answer
735
views
Can RSA-PSS signing be made deterministic without loss of security?
Is it possible to make RSA-PSS signing deterministic without loss of security?
Specifically, I would use Blake2b of the key and message to generate the salt.
- 4,763
21
votes
3
answers
24k
views
Is RSASSA-PKCS1-v1_5 a good signature scheme for new systems?
Is RSASSA-PKCS1-v1_5 a good signature scheme to recommend that people use in new systems? Is it believed to be secure and represent the state-of-the-art in RSA-based signatures?
I understand that RSA-...
- 36.2k
14
votes
1
answer
16k
views
RSA-PSS salt size
One of the inputs of RSA-PSS signing and verification is the salt size. According to PKCS#1, you must know the salt size before the verification is carried out. However, this makes interoperability ...
- 6,404