RSA sign and verify

RSA的签名和验证是由标准文件 PKCS #1 v2.1: RSA Cryptography Standard 定义的

传统认为一段明文用RSA私钥加密后得到签名，签名用响应的公钥来验证。

这其中漏掉了一个最重要的环节，signature padding scheme.下面的图片描述了真实的应用中用到的RSA sign and verify.

 

PKCS 2.1在原来的1.5版本基础上添加了新的encrypt padding和 si'gnature padding

便于以后方便查找，下面附上一些原文：

The signature schemes RSASSA-PKCS-v1_5 ("PKCSV1_5") and RSASSA-PSS ("PSS") have differences. 

• PKCSV1_5 is deterministic. The same message and key will produce an identical signature value each time. PSS is randomized and will produce a different signature value each time (unless you use a zero-length salt).
• A PKCSV1_5 signature is complete in itself. Once decrypted using the private key, you can detect the hash function used to create it and extract the message digest value. A PSS signature has separate parameters (see below) which need to be known prior to verifying a signature. These are included in X.509 certificates and CMS signed-data objects, but need to be communicated separately for an isolated signature value.
• You can extract the message digest value from a PKCSV1_5 signature. You cannot extract it from a PSS signature; you can only verify against a known digest value.
• PSS has a security proof and is more robust in theory than PKCSV1_5. Nevertheless PKCSV1_5 has no known security weaknesses at this time.
• PSS had patent issues until recently (the last one expired in 2010) and is less widely adopted. PKCSV1_5 has been widely used since the 1990s.

PKCS#1v1.5 padding scheme for SHA1:

 

 

The Hash Maigc Code: