RSA-PSS – Provably secure RSA Signatures and their ...

This only works because the first thing done in the whole process is hashingthe message and this is the only place in the whole algorithm where the messageis used at all. With the original algorithm, this would be avoided, as the attackercannot precompute a collision of salt||M when he does not know the salt.For this to have an effect, it is crucial that the salt is put in front of themessage. This is due to the nature of most real-world hash functions (includingMD5, SHA-1, SHA-256) - they are all based on the Merkle-Damgard design.They have an internal state. If we have a collision Hash(M 1 ) = Hash(M 2 ),then this also implies Hash(M 1 ||salt) = Hash(M 2 ||salt). At the point whenthe hash function processes the salt, the internal state of the hash functionis identical and with an identical input following, both will produce the sameoutput.PKCS #1 v2.1 (chapter 9.1, page 37 inthat gives a hint why this choice was made:[RSA Inc., 2002]) contains a noteWithout compromising the security proof for RSASSA-PSS, one mayperform steps 1 and 2 of EMSA-PSS-ENCODE and EMSA-PSS-VERIFY (the application of the hash function to the message) outsidethe module that computes the rest of the signature operation, sothat mHash rather than the message M itself is input to the module.The design of RSASSA-PSS allows to separate the first hashing step fromthe rest of the signature operation. This is especially important for devices likesmart cards where data transfer is limited. One can design applications that onlycalculate the hash of a message and transfer that to a cryptographic unit (likea smart card) that does the signature operation. Beside that, existing signaturesoftware implementations often rely on the separation of message hashing andthe signature operation, because pretty much all signature schemes until nowstart with a hashing operation.So there is a trade-off between a more secure design (PSS96) and less obstaclesin certain implementation scenarios. In the standardization process, theless secure design was chosen. Due to this design decision, the combination ofRSASSA-PSS and a hash function that doesn’t provide collision-resistance createsan insecure algorithm. So it is crucial that a secure hash function is taken.This is especially important to note as the existing standards for RSASSA-PSS define SHA-1 as the default hash function, which can not be consideredcollision-resistant any more.5.3 Randomized HashingIn the aftermath of the collision attacks against MD5 and SHA-1, Shai Haleviand Hugo Krawczyk proposed a method called randomized hashing at theCrypto 2006 conference [Halevi and Krawczyk, 2007]. Later, the NIST hasadopted this in SP-800-106 [Dang, 2009]. Currently there are no efforts underwayin standardizing randomized hashing in cryptographic protocols.21