Use of the RSASSA-PSS Signature Algorithm in Cryptographic Message Syntax (CMS)
Extracted elements (17)
RSASSA-PSS was developed to have more mathematically provable security compared to PKCS #1 v1.5, which was developed in an ad hoc manner. Although no known defects exist in PKCS #1 v1.5, RSASSA-PSS is based on mathematical foundations.
During signature validation, the maskGenAlgorithm field in the certificate subjectPublicKey.algorithm parameters and the signatureAlgorithm parameters MUST be the same.
During signature validation, the saltLength in the signatureAlgorithm parameters MUST be greater than or equal to the saltLength in the certificate subjectPublicKey.algorithm parameters.
During signature validation, the trailerField in the certificate subjectPublicKey.algorithm parameters and signatureAlgorithm parameters MUST be the same. If any of the four validation steps fails, the signature checking algorithm MUST fail validation.
If the subjectPublicKeyInfo algorithm identifier is id-RSASSA-PSS with parameters present, the hashAlgorithm field in the certificate parameters and the signatureAlgorithm parameters MUST be the same during signature validation.
signatureAlgorithm MUST contain id-RSASSA-PSS, and the algorithm parameters field MUST contain RSASSA-PSS-params.
The digestAlgorithms field SHOULD contain the one-way hash function used to compute the message digest on the eContent value.
The same one-way hash function MUST be used for computing the message digest on the signedAttributes and as the hashAlgorithm in the RSA-PSS-params structure.
The same one-way hash function SHOULD be used for computing the message digest on both the eContent and the signedAttributes value if signedAttributes exist.
When the id-RSASSA-PSS algorithm identifier is used for a signature, the AlgorithmIdentifier parameters field MUST contain RSASSA-PSS-params.
When the rsaEncryption algorithm identifier is used for a public key, the AlgorithmIdentifier parameters field MUST contain NULL.
The algorithm identifier for RSASSA-PSS signatures is id-RSASSA-PSS OBJECT IDENTIFIER ::= {pkcs-1 10}. When signing, the RSA algorithm generates a single value used directly as the signature value.
Two algorithm identifiers are used for RSA subject public keys in certificates: rsaEncryption (pkcs-1 1) and id-RSASSA-PSS (pkcs-1 10). The RSA public key is encoded as RSAPublicKey ::= SEQUENCE { modulus INTEGER, publicExponent INTEGER }.
This document does not create any new IANA registries; all ASN.1 structures and OIDs referenced are defined in RFC 4055 (RSA-ALGS).
Implementations must protect the RSA private key; compromise allows signature forgery. The use of inadequate pseudo-random number generators to generate RSA private keys can result in little or no security.
The parameter checking procedures in section 3 are critically important: it is possible to forge signatures by changing (especially to weaker values) the hashAlgorithm, maskGenAlgorithm, saltLength, or trailerField parameter values.
Using the same private key for both PKCS #1 v1.5 and RSASSA-PSS signature algorithms has the potential of allowing an attacker to obtain extra information about the key; it is strongly suggested these not share a key.