Problem - Kevin Tafuro

ecommend using it, unless you are concerned about interoperating with a legacy
application. Otherwise, there is nothing wrong with RSASSA-PKCS1v1.5.
Both schemes should have a similar interface in a cryptographic library supporting
RSA. That is, signing should take the following parameters:
• The signer’s private key.
• The message to be signed. In a low-level API, instead of the actual message, you
will be expected to provide a hash digest of the data you really want to be signing.
High-level APIs will do the message digest operation for you.
• An indication of which message digest algorithm was used in the signing. This
may be assumed for you in a high-level API (in which case it will probably be
SHA1).
RSASSA-PKCS1v1.5 encodes the message digest value into its result to avoid certain
classes of attack. RSASSA-PSS does no such encoding, but it uses a hash function
internally, and that function should generally be the same one used to create the
digest to be signed.
You may or may not need to give an indication of the length of the input message
digest. The value can be deduced easily if the API enforces that the input should be a
message digest value. Similarly, the API may output the signature size, even though it
is a well-known value (the same size as the public RSA modulus—for example, 2,048
bits in 2,048-bit RSA).
OpenSSLsupports RSASSA-PKCS1v1.5 only for digital signatures. It
does support raw encrypting with the private key, which you can use
to implement RSASSA-PSS. However, we don’t generally recommend
this, and you certainly should not use the raw interface (RSA_private_
encrypt( )) for any other purpose whatsoever.
In OpenSSL, we recommend always using the low-level interface to RSA signing,
using the function RSA_sign( ) to perform signatures when you’ve already calculated
the appropriate hash. The signature, defined in openssl/rsa.h, is:
int RSA_sign(int md_type, unsigned char *dgst, unsigned int dlen,
unsigned char *sig, unsigned int *siglen, RSA *r);
This function has the following arguments:
md_type
OpenSSL-specific identifier for the hash function. Possible values are NID_sha1,
NID_ripemd, orNID_md5. A fourth value, NID_md5_sha1, can be used to combine
MD5 and SHA1 by hashing with both hash functions and concatenating the
results. These four constants are defined in the header file openssl/objects.h.
Signing Data Using an RSA Private Key | 339
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.