# Tag Info

Is step #3 (verifying the EMSA-PKCS1-v1_5 padding) important to the security of the system? Yes. That's paramount for small RSA public exponent $e$. For $e\in\{3,5,7\}$, the easily computed integer $s=h^{(e^{-1}\bmod2^{254})}\bmod2^{256}$ is an acceptable signature for any message with an odd SHA-256 hash $h$ (that is about one message out of two). The ...