Internet X.509 Public Key Infrastructure: Additional Algorithm Identifiers for RSASSA-PSS and ECDSA Using SHAKEs
updates
- rfc-3279 — Algorithms and Identifiers for the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
Extracted elements (20)
For ECDSA with SHAKE, the output length of the hash function is explicitly fixed (256 bits for SHAKE128, 512 bits for SHAKE256) for simplicity and compliance with the ECDSA standard specification [X9.62], which requires the output length to be explicitly determined.
SHAKE functions are used natively as the MGF instead of MGF1 because SHAKE is a variable-length extendable-output function, making native use straightforward. All algorithm parameters (hash, MGF, trailer, salt) are embedded in the OID definition itself, eliminating the need for separate RSASSA-PSS-params encoding and simplifying the AlgorithmIdentifier structure.
SHAKE128 and SHAKE256 were not originally specified as hash algorithm options in the X9.62 or SEC1 ECDSA standards. However, SHAKE128 and SHAKE256 with output lengths of 32 and 64 octets respectively can be used in place of SHA256 and SHA512 for ECDSA, as they provide equivalent output sizes.
Conforming CA implementations MUST specify the algorithms explicitly by using the OIDs specified in Section 3 when encoding RSASSA-PSS or ECDSA with SHAKE signatures in certificates and CRLs. Conforming client implementations that process such certificates and CRLs MUST recognize the corresponding OIDs.
Conforming CA implementations MUST specify the X.509 public key algorithm explicitly by using the OIDs specified in Section 3 when encoding ECDSA with SHAKE public keys in certificates and CRLs. Conforming client implementations that process ECDSA with SHAKE public keys MUST recognize the corresponding OIDs.
Conforming CA implementations that generate ECDSA with SHAKE signatures in certificates or CRLs SHOULD generate such signatures with a deterministically generated, nonrandom k in accordance with all the requirements specified in RFC 6979.
For ECDSA with SHAKE, the encoding MUST omit the parameters field. The output length d for SHAKE128 or SHAKE256 used in ECDSA MUST be 256 or 512 bits, respectively.
In RSASSA-PSS with SHAKEs, the SHAKEs MUST be used natively as the MGF, instead of the MGF1 algorithm that uses the hash function in multiple iterations. The trailerField MUST be 1, representing the trailer field with hexadecimal value 0xBC.
The output length of the hash algorithm that hashes the message SHALL be 32 bytes for SHAKE128 or 64 bytes for SHAKE256. The RSASSA-PSS saltLength MUST be 32 bytes for id-RSASSA-PSS-SHAKE128 or 64 bytes for id-RSASSA-PSS-SHAKE256.
The parameters for all four algorithm identifiers (id-RSASSA-PSS-SHAKE128, id-RSASSA-PSS-SHAKE256, id-ecdsa-with-shake128, id-ecdsa-with-shake256) MUST be absent. The AlgorithmIdentifier SHALL be a SEQUENCE of one component: the OID.
When id-RSASSA-PSS-SHAKE128 or id-RSASSA-PSS-SHAKE256 is used, the encoding MUST omit the parameters field. The hash algorithm used to hash the message and the hash algorithm used as the MGF in RSASSA-PSS MUST be the same: both SHAKE128 or both SHAKE256.
When the RSA private key owner wishes to limit public key use exclusively to RSASSA-PSS with SHAKEs, the AlgorithmIdentifiers for RSASSA-PSS defined in Section 3 SHOULD be used as the algorithm field in the SubjectPublicKeyInfo sequence. Conforming client implementations that process RSASSA-PSS with SHAKE public keys MUST recognize the corresponding OIDs.
Four new OIDs are defined for use with SHAKE functions: id-RSASSA-PSS-SHAKE128 (1.3.6.1.5.5.7.6.30), id-RSASSA-PSS-SHAKE256 (1.3.6.1.5.5.7.6.31), id-ecdsa-with-shake128 (1.3.6.1.5.5.7.6.32), and id-ecdsa-with-shake256 (1.3.6.1.5.5.7.6.33). These identifiers can be used for both signature algorithms and subject public key identification in RSASSA-PSS contexts.
The ASN.1 module PKIXAlgsForSHAKE-2019 defines digest algorithms (mda-shake128 with id-shake128 OID 2.16.840.1.101.3.4.2.11, and mda-shake256 with id-shake256 OID 2.16.840.1.101.3.4.2.12), public key types (pk-rsaSSA-PSS-SHAKE128 and pk-rsaSSA-PSS-SHAKE256), and four signature algorithm objects expanding the RFC 5912 framework.
IANA updated the 'Hash Function Textual Names' registry with two entries: 'shake128' with OID 2.16.840.1.101.3.4.2.11 and 'shake256' with OID 2.16.840.1.101.3.4.2.12, both referencing RFC 8692.
IANA updated the 'SMI Security for PKIX Algorithms' registry (1.3.6.1.5.5.7.6) with four entries: decimal 30 for id-RSASSA-PSS-SHAKE128, 31 for id-RSASSA-PSS-SHAKE256, 32 for id-ecdsa-with-shake128, and 33 for id-ecdsa-with-shake256, all referencing RFC 8692.
One OID for the ASN.1 module was assigned in the 'SMI Security for PKIX Module Identifier' registry (1.3.6.1.5.5.7.0): decimal 94 for id-mod-pkix1-shakes-2019, referencing RFC 8692.
A 4096-bit RSA modulus is recommended for SHAKE256 rather than the theoretically required 15360-bit modulus for 256 bits of security, as the latter is impractical for today's technology. Key sizes should be chosen in line with SHAKE output length per NIST SP 800-78-4 and SP 800-107 guidance.
SHAKE128 with 256-bit output offers 128 bits of collision and preimage resistance and is RECOMMENDED with 2048-bit (112-bit security) or 3072-bit (128-bit security) RSA modulus, or curves with 256-bit group order. SHAKE256 with 512-bit output offers 256 bits of resistance and is RECOMMENDED with 4096-bit RSA modulus or curves with at least 512-bit group order such as NIST P-521.
For RSASSA-PSS with SHAKE, the MGF output length maskLen is (8*emLen - 264) bits for SHAKE128 or (8*emLen - 520) bits for SHAKE256, where emLen = ceil((n-1)/8) and n is the RSA modulus in bits. For a 2048-bit modulus, SHAKE128 MGF output is 1784 bits and SHAKE256 MGF output is 1528 bits.