RSA-PSS is a probabilistic RSA signature scheme for producing signatures that should be unforgeable without the private key. It improves on RSA PKCS#1 v1.5 with a security proof and an encoding designed to be easier to implement correctly. section 7.3.2 section 7.5
A simplified signing and verification flow is:
- Encode the message using the PSS encoding algorithm, which uses a mask generation function similar to RSA-OAEP. section 7.3.2
- Sign the encoded message with RSA using the private key, as in the usual RSA signature operation. section 7.3.2
- Verify by raising the signature to the public exponent modulo the public modulus, then inverting and checking the encoding. section 7.3.2
Choosing a signature standard
For a new RSA-based protocol, prefer RSA-PSS over RSA PKCS#1 v1.5: PSS has a security proof and is easier to implement correctly. Older systems may still require PKCS#1 v1.5 because replacing deployed cryptography is slow. section 7.3.2 section 7.5
Figure 7.10 The RSA-PSS signature scheme encodes a message using a mask generation function (MGF) like the RSA-OAEP algorithm you learned about in chapter 6 before signing it in the usual RSA way.
Visualize how PSS uses a mask generation function before the encoded message undergoes the usual RSA signing operation. section 7.3.2
