Subject: [pkix] SHA256: also recommended for RSASSA-PSS (RFC 3447) ?

From: Adriano Santoni <[email-masked]>
Date: Thu, 07 Jan 2010 12:31:40 +0100

Hi all,

please bear with me if this is not the "right" list to discuss this 
topic....

My question arises from the fact that certain documents (e.g. 
regulations, papers, etc) recommends a switch from SHA1 to SHA256, quite 
soon, because SHA1 has started showing some weaknesses.

I am asking myself, and would appreciate some comments and insight from 
the PKIX community, if a transition to SHA256 as the hashing function 
for computing the message-digest signed attribute within a SignerInfo 
structure (part of a CMS or CADES message) should imply the adoption of 
the same hashing function also for "scrambling" the message digest into 
the encryption buffer according to RFC 3447 (section 8.1: RSASSA-PSS).

Would using SHA256 in the RSASSA-PSS scheme be significantly more secure 
than using SHA1 ?

TIA to all commenters.

Adriano

---

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 07 Jan 2010 15:22:48 -0700

> Would using SHA256 in the RSASSA-PSS scheme be significantly more secure

And: which code libraries support the RSA 2.1 algorithms?

---

From: Thomas Pornin <[email-masked]>
Date: Fri, 8 Jan 2010 14:17:41 +0100

On Thu, Jan 07, 2010 at 12:31:40PM +0100, Adriano Santoni wrote:
> I am asking myself, and would appreciate some comments and insight
> from the PKIX community, if a transition to SHA256 as the hashing
> function for computing the message-digest signed attribute within a
> SignerInfo structure (part of a CMS or CADES message) should imply
> the adoption of the same hashing function also for "scrambling" the
> message digest into the encryption buffer according to RFC 3447
> (section 8.1: RSASSA-PSS).

Just to be precise, we have three hash functions here:

-- the hash function which is used to compute the contents of a
message-digest signed attribute (let's call it h1);
-- the hash function used to process the message which is to be signed,
as the first step of signature generation per PKCS#1 (the input to
that function is the encoding of the signed attributes) (call it h2);
-- the hash function used internally to PSS as part of the "mask
generation function" (MGF) (let's call it h3).

A MGF is not necessarily based on a hash function, but only one MGF is
defined, called MGF1, and that one uses a hash function (which I call
here h3). PKCS#1 recommends, in that situation, that h2 = h3. This is
not mandatory, but recommended nonetheless, so let's assume that this is
ture.

The reasons which would make you prefer SHA-256 over SHA-1 for h1 mostly
apply to the choice of h2 too. Right now, known weaknesses in SHA-1 point
to the possibility of creating a collision; such weaknesses are most
likely to apply in a practical situation when the "bad guy" can control
substantial parts of the input to the hash function. In the case of h2,
in some setups, the bad guy may add arbitrary signed attributes of his
own choosing. So the short answer is: yes, if you think that SHA-1 is
too insecure for use as h1, then it is probably too insecure for use as
h2 too.

> Would using SHA256 in the RSASSA-PSS scheme be significantly more
> secure than using SHA1 ?

Anyway it will not be worse, and anyway, unifying all hash function
usages to a single hash function within a data processing path is often
good for performance and maintainability.

	--Thomas Pornin