Problem - Kevin Tafuro

7.12 Signing Data Using an RSA Private Key
Problem
You want to use RSA to digitally sign data.
Solution
Use a well-known one-way hash function to compress the data, then use a digital
signing technique specified in PKCS #1 v2.0 or later. Any good cryptographic library
should have primitives for doing exactly this. OpenSSLprovides both a low-level
interface and a high-level interface, although the high-level interface doesn’t end up
removing any complexity.
Discussion
Digital signing with RSA is roughly equivalent to encrypting with a private key. Basically,
the signer computes a message digest, then encrypts the value with his private
key. The verifier also computes the digest and decrypts the signed value, comparing
the two. Of course, the verifier has to have the valid public key for the entity whose
signature is to be verified, which means that the public key needs to be validated by
some trusted third party or transmitted over a secure medium such as a trusted courier.
Digital signing works because only the person with the correct private key will produce
a “signature” that decrypts to the correct result. An attacker cannot use the
public key to come up with a correct encrypted value that would authenticate properly.
If that were possible, it would end up implying that the entire RSA algorithm
could be broken.
PKCS #1 v2.0 specifies two different signing standards, both of which are assumed to
operate on message digest values produced by standard algorithms. Basically, these
standards dictate how to take a message digest value and produce a “signature.” The
preferred standard is RSASSA-PSS, which is analogous to RSAES-OAEP, the padding
standard used for encryption. It has provable security properties and therefore is no
less robust than the alternative, RSASSA-PKCS1v1.5. * There aren’t any known problems
with the RSASSA-PKCS1v1.5, however, and it is in widespread use. On the
other hand, few people are currently using RSASSA-PSS. In fact, OpenSSLdoesn’t
support RSASSA-PSS. If RSASSA-PSS is available in your cryptographic library, we
* There is a known theoretical problem with RSASSA-PKCS1v1.5, but it is not practical, in that it’s actually
harder to attack the scheme than it is to attack the underlying message digest algorithm when using SHA1.
338 | Chapter 7: Public Key Cryptography
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.