Skip to main content
14 votes
Accepted

Should I be using PKCS1 v1.5 or PSS for RSA signatures?

Which of these should I be using? PKCS1 v1.5 seems a bit simpler to implement. Generally you should not be implementing this yourself, there are plenty of libraries that implement these schemes out ...
Maarten Bodewes's user avatar
  • 93.4k
14 votes
Accepted

What is the difference between RSASSA-PSS signing and RSA-PSS signing?

Some authors draw a distinction between: RSA-PSS, analyzed by Bellare and Rogaway in 1996[1] and proposed for IEEE P1363 in 1998[2], which is roughly defined in terms of $H(r \mathbin\| m)$, and ...
Squeamish Ossifrage's user avatar
14 votes
Accepted

What's the difference between rsa_pss_pss_* and rsa_pss_rsae_* schemes?

Summary: they aren't different signature schemes. Both specify the use of RSA-PSS. The difference is in how to parse the certificate to find the public key. RSA-PSS (also spelled RSASSA-PSS and other ...
Gilles 'SO- stop being evil''s user avatar
12 votes
Accepted

Why does OpenSSL differentiate between PSS and non-PSS for private key generation?

If you reuse the same key material for different algorithms, you rely not on the security of any one algorithm individually, but on the security of the composition of the two algorithms simultaneously....
Squeamish Ossifrage's user avatar
11 votes
Accepted

What is RSA-PSS and how is it different from a hash?

A fixed hash function can be computed by anyone. A signature depends also on a public key, and can be computed only by someone who knows a secret related to the public key. Anyone can verify a ...
Squeamish Ossifrage's user avatar
7 votes

What are I2OSP & OS2IP in RSA PKCS#1?

I2OSP and OS2IP mean Integer to Octet Stream Primitive and Octet Stream to Integer Primitive. There is an often used play on words here: "two" (2) has almost the same pronunciation as "...
Maarten Bodewes's user avatar
  • 93.4k
7 votes

Why does OpenSSL differentiate between PSS and non-PSS for private key generation?

OpenSSL is not being dumb and there is a reason the keys have different OIDs, but it's unrelated to the key data — it's the key metadata. The metadata describes the key. Specifically, the ASN.1 type ...
datKiDfromNY's user avatar
7 votes
Accepted

Is there an easy way to make textbook RSA secure enough so it can be used in real life?

Actually, RSASSA-PKCS1-v1_5 signature padding is quite simple, and has no known weaknesses (the similarly named RSAES-PKCS1-v1_5 padding is broken for encryption unless implemented in a very very ...
poncho's user avatar
  • 148k
6 votes

Attack on security model for RSA-FDH

This is a) no attack on the security model, but an attack in the security model of EUF-CMA, and b) a generic attack on any signature scheme that signs the hash of a message instead of the message ...
mephisto's user avatar
  • 2,908
6 votes

Why does OpenSSL differentiate between PSS and non-PSS for private key generation?

For the private key it may or may not matter to code using the key, but for the public key especially in a CSR or cert the algorithm identifier is visible and can matter. OpenSSL generates a CSR ...
dave_thompson_085's user avatar
6 votes

What is the difference between RSASSA-PSS signing and RSA-PSS signing?

There is only one standard cryptographic mechanism that uses both the RSA trapdoor function family and the PSS padding scheme, and that's RSASSA-PSS defined by PKCS#1 v2.1 and above (RFC 8017 being ...
Gilles 'SO- stop being evil''s user avatar
6 votes

Is there an easy way to make textbook RSA secure enough so it can be used in real life?

There is also a more simple but not well-known signature scheme for RSA; RSA Full Domain Hash It has existentially unforgeable under adaptive chosen-message attacks in the random oracle model. ...
kelalaka's user avatar
  • 49.1k
5 votes
Accepted

Why does PSS produce an EM message that's almost as long as the modulus?

Why PSS does not use a last call to a hash function (for instance SHA-256) so as to reduce the size of the resulting element before performing the exponentiation? There's a radical reason why: it ...
fgrieu's user avatar
  • 142k
5 votes

Are RSA-PSS parameters standardized?

Let's first get rid over two parameters that only have one option: the Mask Generation Function (MGF) and the trailer field. These can only be configured to MGF1 and 1 respectively in RFC 3447 which ...
Maarten Bodewes's user avatar
  • 93.4k
4 votes
Accepted

RSA Signing: SHA512 incompatible with PSS?

Yes, this is expected, if the RSASSA-PSS signing code/test uses salt the width of the hash, which is customary. In that case, a $h$-bit hash (with $h$ multiple of 8) requires an RSA public modulus at ...
fgrieu's user avatar
  • 142k
4 votes

RSA PSS security advantage

Even if we make RSASSA-PSS deterministic by fixing its seed, it remains with a security proof in the Random Oracle Model per Full Domain Hashing (Jean-Sébastien ...
fgrieu's user avatar
  • 142k
4 votes

What's the difference between rsa_pss_pss_* and rsa_pss_rsae_* schemes?

As mentioned already, very good question. What follows is my attempt at tracking down the answer. I first googled for rsa_pss_rsae_sha256 wireshark and the first result was https://fossies.org/linux/...
iam's user avatar
  • 141
4 votes

What is RSA-PSS and how is it different from a hash?

The paper : PSS: Provably Secure Encoding Method for Digital Signatures by Bellare and Rogaway in August 1998 RSA-PSS is a signature scheme based on the RSA assumption, similar to how RSA encryption ...
yanofearth's user avatar
4 votes

Why does PSS produce an EM message that's almost as long as the modulus?

To prove that, for a generic hash function, forging PSS signatures is not much easier than computing arbitrary $e^\mathit{th}$ roots modulo a large composite of unknown factorization, we need to grant ...
Squeamish Ossifrage's user avatar
4 votes

which exponent to be used for RSA e =3 or 65537 for RSASSAPSS signature verification

Use the value of public exponent $e$ that came with the public key, here $e=3$ according to the question. Otherwise, signatures won't check. Common RSA public exponents include $65537$ and $3$, and ...
fgrieu's user avatar
  • 142k
4 votes
Accepted

Implications of switching RSA padding schemes

Read the next section for why it's likely not necessary to make any change. But let's answer the question anyway. If an adversary can see many similar messages that were signed with both (RSASSA-...
fgrieu's user avatar
  • 142k
3 votes

Is RSASSA-PKCS1-v1_5 a good signature scheme for new systems?

I'm not going to add any analysis, but just some RFC quotes and timelines about RSA signing ('signature scheme with appendix'), PKCS #1 v1.5 and PSS ('probabilistic signature scheme') February 2003 ...
Nick T's user avatar
  • 261
3 votes
Accepted

Security of RSA signature using PKCS 1.5

Provided you follow PKCS#1 v1.5 verification exactly, and don't attempt shortcuts like checking only the hash part of the message hash representative, it should be fine. There's no security reduction ...
Squeamish Ossifrage's user avatar
3 votes
Accepted

How to identify RSASSA-PSS from rsaEncryption OID?

There are two different identifiers in a certificate, the algorithm of the public key for the certificate and the algorithm of the signature from the issuer. The two don't have to even be the same ...
bartonjs's user avatar
  • 564
3 votes
Accepted

PKCS#1: Purpose of `Padding1` in EMSA-PSS encoding method

I conjecture that this salt is essentially a version number for future extensions, tasked with ensuring that signature per another version using a different salt is not a valid signature for the ...
fgrieu's user avatar
  • 142k
3 votes
Accepted

What salt should be used when generating TLS 1.3 CertificateVerify message?

The salt should be generated randomly. This is how PSS encoding is defined: the salt length is an input, and the encoding process generates a random salt of the specified length. The PSS verification ...
Gilles 'SO- stop being evil''s user avatar
3 votes
Accepted

Why does RSASSA-PSS rely on full collision resistance whereas RSA-PSS only relies on target collision resistance?

An RSA PSS signature of either type provides assurance both that a message and a salt were sent that hash to a particular value (essentially either $H(r||m)$ or $H(r||H(m))$) AND that the value of the ...
Daniel S's user avatar
  • 24.1k
3 votes

Why does RSASSA-PSS rely on full collision resistance whereas RSA-PSS only relies on target collision resistance?

In RSASSA-PSS signature verification, the message to verify is used only as input to EMSA-PSS-VERIFY. And then $M$ is only used to check it's length is small enough for hashing (step 1), and to ...
fgrieu's user avatar
  • 142k
2 votes
Accepted

RSASSA-PSS in TLS 1.2

If the client announces in the Signature Algorithm Extension that it supports one of the RSA-PSS: ...
bebbo's user avatar
  • 156
2 votes

On what basis is padding chosen in OpenSSL?

Q: I am using CAPI Engine in OpenSSL and I did some test. When I use TLS 1.0 or 1.1, during handshake and RSA signing, PKCS padding is chosen. When I use TLS 1.2, RSA signing uses PSS padding. Funny, ...
Maarten Bodewes's user avatar
  • 93.4k

Only top scored, non community-wiki answers of a minimum length are eligible