RSA-PSS for Digital Signatures
Learn PSS encoding, salt, and why it replaced PKCS#1 v1.5 for signing.
Welcome
RSA-PSS (Probabilistic Signature Scheme) is the secure replacement for PKCS#1 v1.5 signatures. It uses randomized encoding for provably secure signatures.
PKCS#1 v1.5 Signature Weaknesses
PKCS#1 v1.5 signatures use a deterministic DigestInfo encoding. Known forgery attacks exploit loose verification implementations. Bleichenbacher (2006) showed signature forgeries against certain verifiers.
All lessons in this course
- Textbook RSA & Why It Is Insecure
- PKCS#1 v1.5 Padding & Bleichenbacher
- OAEP: Optimal Asymmetric Encryption Padding
- RSA-PSS for Digital Signatures