RSA-PSS – Provably secure RSA Signatures and their ...

side: Every decryption operation produces four possible outputs and thus isnot suitable for practical applications. Williams suggested a change that avoidsthis ambiguities [Williams, 1980]. This is called the Rabin-Williams algorithm,abbreviated RW. We will come back to discuss Rabin-Williams in chapter 3.6.The original Rabin algorithm already included the idea of hashing a messagebefore signing - a concept which became also crucial to make RSA secure, as wewill see in the next chapter.2.4 Plain / Textbook RSAIn the algorithm defined in the original RSA paper [Rivest et al., 1977], thefunction for signing is S = M e mod N, for verification M = S d mod N (S:Signature, M: Message, e, N: public key, d, N: private key). This originalversion – often called textbook RSA – has security problems. Assuming anattacker has messages M 1 and M 2 and signatures S(M 1 ) and S(M 2 ). Due tothe nature of the RSA signature function, (S(M 1 )·S(M 2 )) mod N would give avalid signature for (M 1 · M 2 ) mod N. This is called the multiplicative propertyof the RSA algorithm [Davida, 1982].Another problem of the original, unpadded RSA scheme is the fact that theencryption operation is directly the inverse of the signature operation. Thus,if a person is using the same RSA key pair for both signing and encryption,an attacker might be able to give the person encrypted data and asks for asignature. If the victim signs, the signature contains the decrypted data. Whilethis may sound like an unrealistic threat, signature generation is often part ofan automated system.2.5 Hash FunctionsA way to avoid attack vectors against plain RSA is the use of a cryptographichash function. A hash function is a one-way function mapping any input toan output of a fixed length. A cryptographic hash function can be classifiedby certain properties. The most important one is collision resistance: A hashfunction is called collision resistant if it is not possible for an attacker to generatetwo different inputs which produce the same output in a reasonable amount oftime (in mathematical terms, it shall not be possible to efficiently generate M 1and M 2 so that M 1 ≠ M 2 and Hash(M 1 ) = Hash(M 2 )).If for a given hash H and a message M 1 with H = Hash(M 1 ) an attacker isable to create a message M 2 with Hash(M 1 ) = Hash(M 2 ), this is called a secondpreimage attack. If for a given hash H an attacker is able to generate a messageM so that H = Hash(M), this is called a preimage attack.For simple signature schemes, it is necessary to have a hash function whichis collision resistant. We will later see that in certain scenarios a preimageresistant hash function may be enough.7