RSA-PSS – Provably secure RSA Signatures and their ...

PKCS #1 v2.1 specifies the use of PSS with either SHA-1 or one of the SHA-2 (SHA-256, SHA-384, SHA-512) algorithms. Later standards like RFC 4055(PSS signatures for X.509) additionally allow SHA-224. The proposed defaultis SHA-1.However, it is highly suggested not to use SHA-1 anymore. We alreadydiscussed the weaknesses of still widely used hash functions MD5 and SHA-1in chapter 2.5. Up until now, the SHA-2-family (SHA-224, SHA-256, SHA-385, SHA-512) can be considered secure and is the only widely accepted hashstandard without known weaknesses.As PSS is a safety measure against unknown attacks, it barely makes anysense to use it with SHA-1, where attacks are already known. The switch fromMD5/SHA-1 to SHA-2 should have a higher priority than the implementationof PSS padding.6.2 Key SizeFor a long time, RSA key sizes between 512 and 768 bit were quite common.They should be considered completely insecure today, although they still canbe found in real-world applications. In 2010, a research team factorized a 768bit number [Kleinjung et al., 2010]. In 2009, it was possible to factorize a 512bit key used for signing the operating system of a Texas Instruments calculatorby a private person on a home computer [ticalc.org, 2009]. Those attacks havealso questioned the security of RSA with 1024 bit.In 2003, Adi Shamir (one of the original RSA authors) proposed a theoreticaldesign for a hypothetical device called TWIRL (The Weizmann Institute RelationLocator) that would be capable of factoring large numbers up to 1024 bitin less than a year with a 10 million dollar device [Shamir and Tromer, 2003].This would fully break RSA with a key size of 1024 bit or lower, meaning thatthe private key can be revealed with knowledge of the public key.Due to the high costs, nobody has publicly built a TWIRL device. However,as with the transition to new hash functions, the transition to key sizes above1024 bit should have higher priority than the transition to PSS and while intheory possible, it barely makes sense to use PSS with a RSA key size of 1024bit. RSA Inc. as well as the NIST propose not to use 1024 bit keys after 2010any more.6.3 ExponentIn its early days, RSA was done with a random, large-sized exponent. Later,it became prevalent that for better performance in the encryption / verificationprocess, very small exponents like e = 3 could be used. Textbook RSA incombination with a small exponent raises a number of issues, but all of themcan be avoided with padding and hashing.25