On the Security of RSA-PSS in the Wild

摘要: The RSA Probabilistic Signature Scheme (RSA-PSS) due to Bellare and Rogaway (EUROCRYPT 1996) is a widely deployed signature scheme. In particular it suggested replacement for the deterministic Full Domain Hash (RSA-FDH) by (ACM CCS 1993) PKCS# v1.5 (RFC 2313), as can provide stronger security guarantees. It has since been shown Kavki Kiltz 2012, Journal of Cryptology 2018) that RSA-FDH provides similar RSA-PSS, also in case when RSA-PSS not randomized. Recently, Jager, Kakvi May showed PKCS#1 gives comparable both RSA-PSS. However, all these proofs consider each scheme isolation, where practice this case. most interesting TLS 1.3, signatures are still included reasons backwards compatibility, meaning implemented. To save space, key material shared between two schemes, which means aforementioned no longer apply. We investigate joint usage context Sibling Signatures, were introduced Camenisch, Drijvers, Dubovitskaya 2017). must be noted we standardised version (IEEE Standard P1363-2000), deviates from original considered previous papers. able show indeed secure, achieves level closely matches PKCS\#1 schemes safely used, if output lengths hash functions chosen appropriately.