RSASSAPSS

RSASSA-PSS, or RSA Signature with Probabilistic Signature Scheme, is a padding scheme for RSA digital signatures. It is defined in PKCS #1 and standardized in RFC 8017. Unlike traditional deterministic RSA padding, RSASSA-PSS incorporates randomness through a salt, producing a different signature for the same message on each signing. This probabilistic approach improves security against certain forgery and side-channel attacks while preserving RSA’s mathematical foundation.

How it works in brief: a hash of the message is computed with a chosen hash function (for example SHA-256); a random salt is generated; the hash and salt are combined in a padding construction that uses a mask generation function based on the same hash. The resulting encoded message is then signed with the RSA private key by modular exponentiation. Verification recomputes the encoding from the signature and checks the match with the message hash. The scheme’s randomness means signatures are not fixed for identical messages, enhancing security against some attack vectors.

Parameter choices and implications: the RSA modulus length is typically 2048 bits or greater; the hash function is usually SHA-256 or stronger; the salt length is commonly equal to the hash length; the mask generation function MGF1 uses the same hash. The encoding length must fit within the RSA modulus, and signature verification requires matching the hash and salt as specified by the standard. Correct parameter selection is important for security guarantees.

Standards and usage: RSASSA-PSS is part of PKCS #1 and is supported in modern cryptographic libraries and protocols, including RSA-PSS variants in TLS (for example, sha256WithRSA-PSS) and S/MIME. It is generally more resistant to certain attack vectors than the older RSASSA-PKCS1 v1.5, though it can be slower and may face compatibility issues with legacy systems.