# Tag Info

3

Yes, this is expected, if the RSASSA-PSS signing code/test uses salt the width of the hash, which is customary. In that case, a $h$-bit hash (with $h$ multiple of 8) requires an RSA public modulus at least $2h+9$ bits. That's semi-clearly stated in PKCS#1 v2.2, section 9.1.1, condition on enBits, with actual test in step 3. That's because the message ...

3

Q1: The random selection should be $\sqrt[3]{n}<m<n$ due to cube-root attack? Suppose $n$ is 2048 bits long. Then $\sqrt[3] n < 2^{700}$. If $m$ is uniformly distributed in $\{1, 2, \dots, n - 1, n\}$, what is $\Pr[m < \sqrt[3] n]$? Is this probability large enough that you have to worry about it? Now at the end the document it says; ...

3

The maximum payload for each encryption using RSA OAEP is displayed here. For any message up to that size a complete RSA operation needs to be performed. Of course, if you encrypt each byte separately then you won't get much performance, and your ciphertext will expand enormously. You need to make sure that you use the entire possible payload for each ...

2

node-jose only supports RSA OAEP with SHA-1 and no MGF1 or RSA OAEP with SHA-256 and no MGF1 That's extremely unlikely since OAEP does need to use a Mask Generation Function, and there is only one defined: MGF1. So maybe it doesn't specify it explicitly, but it really must support it to be called OAEP. But I'm wondering about RSA OAEP SHA-1. Nimbus JOSE ...

Only top voted, non community-wiki answers of a minimum length are eligible