RSA-PSS – Provably secure RSA Signatures and their ...

In the PKCS standard, the old and new signature schemes are calledRSASSA-PSS and RSASSA-PKCS1-v1 5, the underlying encoding operationsEMSA-PSS and EMSA-PKCS1-v1 5. These naming conventions will be usedwithin this document. If we refer specifically to the original PSS version, wewill call it PSS96.3.4 Mask Generation FunctionPSS requires a so-called mask generation function. This is basically like a hashfunction, but with a variable output size. In other contexts, similar functionsare also called key derivation functions. The PKCS #1 v2.1 standard lists onlyone possible function, MGF1. It is based on an existing hash algorithm andjust works by using the input plus a four byte counter starting with zero as aninput for the hash function and increment the counter to get enough output bitsfrom the hash function. The last output is cut to get the required size. MGF1is mostly equivalent to the key derivation function KDF2, as specified in ISO18033-2 [ISO, 2006].MGF1 has the property that two calls to MGF1 with the same hash functionand the same input with a different output size would lead to an output identicalat the beginning. For example, if we calculate both MGF1(SHA-256, "hello",10) and MGF1(SHA-256, "hello", 20), we get:MGF1(SHA-256, "hello", 10) = da75447e22f9f99e1be0MGF1(SHA-256, "hello", 15) = da75447e22f9f99e1be09a00cf1a07As we see, the first 10 bytes of the second MGF1 output are identical to thefirst MGF1 output.This looks like an unideal cryptographic property of a mask generation function.This has no impact on PSS – the only possible scenario where one wouldhave the same input to MGF1 and a different output length would be if one usedthe same salt and message with a different key size (compare figure 4). So withina proper implementation of RSASSA-PSS, the use of MGF1 is just fine. However,if MGF1 is used within other cryptographic constructions, this propertyshould be consider and it should be investigated if it causes any problems.3.5 Patents on PSSThe University of California has filed two patents on PSS[Bellare and Rogaway, 2001] [Bellare and Rogaway, 2006]. During thestandardization process for IEEE P1363a, they claimed that if PSS withappendix gets standardized, they will freely license the patent to anyone doingimplementations of the standard [Grell and University of California, 1999].They would however charge fees for PSS with message recovery.Both patents have not been renewed and thus #6,266,771 expired on July24, 2009 and #7,036,014 expired on April 25, 2010. So currently, PSS in any15