Steps:
1.If l > 2^32(hLen), output "mask too long" and stop.
2.Let T be the empty octet string.
3.For counter from 0 to \lceil{l / hLen}\rceil-1, do the following:
a.Convert counter to an octet string C of length 4 with the primitive
I2OSP: C = I2OSP (counter, 4)
b.Concatenate the hash of the seed Z and C to the octet string T: T =
T || Hash (Z || C)
4.Output the leading l octets of T as the octet string mask.
11. ASN.1 syntax
11.1 Key representation
This section defines ASN.1 object identifiers for RSA public and
private keys, and defines the types RSAPublicKey and RSAPrivateKey.
The intended application of these definitions includes X.509
certificates, PKCS #8 [22], and PKCS #12 [23].
The object identifier rsaEncryption identifies RSA public and private
keys as defined in Sections 11.1.1 and 11.1.2. The parameters field
associated with this OID in an AlgorithmIdentifier shall have type
NULL.
rsaEncryption OBJECT IDENTIFIER ::= {pkcs-1 1}
All of the definitions in this section are the same as in PKCS #1
v1.5.
11.1.1 Public-key syntax
An RSA public key should be represented with the ASN.1 type
RSAPublicKey:
RSAPublicKey::=SEQUENCE{
modulus INTEGER, -- n
publicExponent INTEGER -- e }
(This type is specified in X.509 and is retained here for
compatibility.)
The fields of type RSAPublicKey have the following meanings:
-modulus is the modulus n.
-publicExponent is the public exponent e.
11.1.2 Private-key syntax
An RSA private key should be represented with ASN.1 type
RSAPrivateKey:
RSAPrivateKey ::= SEQUENCE {
version Version,
modulus INTEGER, -- n
publicExponent INTEGER, -- e
privateExponent INTEGER, -- d
prime1 INTEGER, -- p
prime2 INTEGER, -- q
exponent1 INTEGER, -- d mod (p-1)
exponent2 INTEGER, -- d mod (q-1)
coefficient INTEGER -- (inverse of q) mod p }
Version ::= INTEGER
The fields of type RSAPrivateKey have the following meanings:
-version is the version number, for compatibility with future
revisions of this document. It shall be 0 for this version of the
document.
-modulus is the modulus n.
-publicExponent is the public exponent e.
-privateExponent is the private exponent d.
-prime1 is the prime factor p of n.
-prime2 is the prime factor q of n.
-exponent1 is d mod (p-1).
-exponent2 is d mod (q-1).
-coefficient is the Chinese Remainder Theorem coefficient q-1 mod p.
11.2 Scheme identification
This section defines object identifiers for the encryption and
signature schemes. The schemes compatible with PKCS #1 v1.5 have the
same definitions as in PKCS #1 v1.5. The intended application of
these definitions includes X.509 certificates and PKCS #7.
11.2.1 Syntax for RSAES-OAEP
The object identifier id-RSAES-OAEP identifies the RSAES-OAEP
encryption scheme.
id-RSAES-OAEP OBJECT IDENTIFIER ::= {pkcs-1 7}
The parameters field associated with this OID in an
AlgorithmIdentifier shall have type RSAEP-OAEP-params:
RSAES-OAEP-params ::= SEQUENCE {
hashFunc [0] AlgorithmIdentifier {{oaepDigestAlgorithms}}
DEFAULT sha1Identifier,
maskGenFunc [1] AlgorithmIdentifier {{pkcs1MGFAlgorithms}}
DEFAULT mgf1SHA1Identifier,
pSourceFunc [2] AlgorithmIdentifier
{{pkcs1pSourceAlgorithms}}
DEFAULT pSpecifiedEmptyIdentifier }
The fields of type RSAES-OAEP-params have the following meanings:
-hashFunc identifies the hash function. It shall be an algorithm ID
with an OID in the set oaepDigestAlgorithms, which for this version
shall consist of id-sha1, identifying the SHA-1 hash function. The
parameters field for id-sha1 shall have type NULL.
oaepDigestAlgorithms ALGORITHM-IDENTIFIER ::= {
{NULL IDENTIFIED BY id-sha1} }
id-sha1 OBJECT IDENTIFIER ::=
{iso(1) identified-organization(3) oiw(14) secsig(3)
algorithms(2) 26}
The default hash function is SHA-1:
sha1Identifier ::= AlgorithmIdentifier {id-sha1, NULL}
-maskGenFunc identifies the mask generation function. It shall be an
algorithm ID with an OID in the set pkcs1MGFAlgorithms, which for
this version shall consist of id-mgf1, identifying the MGF1 mask
generation function (see Section 10.2.1). The parameters field for
id-mgf1 shall have type AlgorithmIdentifier, identifying the hash
function on which MGF1 is based, where the OID for the hash function
shall be in the set oaepDigestAlgorithms.
pkcs1MGFAlgorithms ALGORITHM-IDENTIFIER ::= {
{AlgorithmIdentifier {{oaepDigestAlgorithms}} IDENTIFIED
BY id-mgf1} }
id-mgf1 OBJECT IDENTIFIER ::= {pkcs-1 8}
The default mask generation function is MGF1 with SHA-1:
mgf1SHA1Identifier ::= AlgorithmIdentifier {
id-mgf1, sha1Identifier }
-pSourceFunc identifies the source (and possibly the value) of the
encoding parameters P. It shall be an algorithm ID with an OID in the
set pkcs1pSourceAlgorithms, which for this version shall consist of
id-pSpecified, indicating that the encoding parameters are specified
explicitly. The parameters field for id-pSpecified shall have type
OCTET STRING, containing the encoding parameters.
pkcs1pSourceAlgorithms ALGORITHM-IDENTIFIER ::= {
{OCTET STRING IDENTIFIED BY id-pSpecified} }
id-pSpecified OBJECT IDENTIFIER ::= {pkcs-1 9}
The default encoding parameters is an empty string (so that pHash in
EME-OAEP will contain the hash of the empty string):
pSpecifiedEmptyIdentifier ::= AlgorithmIdentifier {
id-pSpecified, OCTET STRING SIZE (0) }
If all of the default values of the fields in RSAES-OAEP-params are
used, then the algorithm identifier will have the following value:
RSAES-OAEP-Default-Identifier ::= AlgorithmIdentifier {
id-RSAES-OAEP,
{sha1Identifier,
mgf1SHA1Identifier,
pSpecifiedEmptyIdentifier } }
11.2.2 Syntax for RSAES-PKCS1-v1_5
The object identifier rsaEncryption (Section 11.1) identifies the
RSAES-PKCS1-v1_5 encryption scheme. The parameters field associated
with this OID in an AlgorithmIdentifier shall have type NULL. This is
the same as in PKCS #1 v1.5.
RsaEncryption OBJECT IDENTIFIER ::= {PKCS-1 1}
11.2.3 Syntax for RSASSA-PKCS1-v1_5
The object identifier for RSASSA-PKCS1-v1_5 shall be one of the
following. The choice of OID depends on the choice of hash algorithm:
MD2, MD5 or SHA-1. Note that if either MD2 or MD5 is used then the
OID is just as in PKCS #1 v1.5. For each OID, the parameters field
associated with this OID in an AlgorithmIdentifier shall have type
NULL.
If the hash function to be used is MD2, then the OID should be:
md2WithRSAEncryption ::= {PKCS-1 2}
If the hash function to be used is MD5, then the OID should be:
md5WithRSAEncryption ::= {PKCS-1 4}
If the hash function to be used is SHA-1, then the OID should be:
sha1WithRSAEncryption ::= {pkcs-1 5}
In the digestInfo type mentioned in Section 9.2.1 the OIDS for the
digest algorithm are the following:
id-SHA1 OBJECT IDENTIFIER ::=
{iso(1) identified-organization(3) oiw(14) secsig(3)
algorithms(2) 26 }
md2 OBJECT IDENTIFIER ::=
{iso(1) member-body(2) US(840) rsadsi(113549)
digestAlgorithm(2) 2}
md5 OBJECT IDENTIFIER ::=
{iso(1) member-body(2) US(840) rsadsi(113549)
digestAlgorithm(2) 5}
The parameters field of the digest algorithm has ASN.1 type NULL for
these OIDs.
12. Patent statement
The Internet Standards Process as defined in RFC1310 requires a
written statement from the Patent holder that a license will be made
available to applicants under reasonable terms and conditions prior
to approving a specification as a Proposed, Draft or Internet
Standard.
The Internet Society, Internet Architecture Board, Internet
Engineering Steering Group and the Corporation for National Research
Initiatives take no position on the validity or scope of the
following patents and patent applications, nor on the appropriateness
of the terms of the assurance. The Internet Society and other groups
mentioned above have not made any determination as to any other
intellectual property rights which may apply to the practice of this
standard. Any further consideration of these matters is the user's
responsibility.
12.1 Patent statement for the RSA algorithm
The Massachusetts Institute of Technology has granted RSA Data
Security, Inc., exclusive sub-licensing rights to the following
patent issued in the United States:
Cryptographic Communications System and Method ("RSA"), No. 4,405,829
RSA Data Security, Inc. has provided the following statement with
regard to this patent:
It is RSA's business practice to make licenses to its patents
available on reasonable and nondiscriminatory terms. Accordingly, RSA
is willing, upon request, to grant non-exclusive licenses to such
patent on reasonable and non-discriminatory terms and conditions to
those who respect RSA's intellectual property rights and subject to
RSA's then current royalty rate for the patent licensed. The royalty
rate for the RSA patent is presently set at 2% of the licensee's
selling price for each product covered by the patent. Any requests
for license information may be directed to:
Director of Licensing
RSA Data Security, Inc.
2955 Campus Drive
Suite 400
San Mateo, CA 94403
A license under RSA's patent(s) does not include any rights to know-
how or other technical information or license under other
intellectual property rights. Such license does not extend to any
activities which constitute infringement or inducement thereto. A
licensee must make his own determination as to whether a license is
necessary under patents of others.
13. Revision history
Versions 1.0-1.3
Versions 1.0-1.3 were distributed to participants in RSA Data
Security, Inc.'s Public-Key Cryptography Standards meetings in
February and March 1991.
Version 1.4
Version 1.4 was part of the June 3, 1991 initial public release of
PKCS. Version 1.4 was published as NIST/OSI Implementors' Workshop
document SEC-SIG-91-18.
Version 1.5
Version 1.5 incorporates several editorial changes, including updates
to the references and the addition of a revision history. The
following substantive changes were made: -Section 10: "MD4 with RSA"
signature and verification processes were added.
-Section 11: md4WithRSAEncryption object identifier was added.
Version 2.0 [DRAFT]
Version 2.0 incorporates major editorial changes in terms of the
document structure, and introduces the RSAEP-OAEP encryption scheme.
This version continues to support the encryption and signature
processes in version 1.5, although the hash algorithm MD4 is no
longer allowed due to cryptanalytic advances in the intervening
years.
14. References
[1] ANSI, ANSI X9.44: Key Management Using Reversible Public Key
Cryptography for the Financial Services Industry. Work in
Progress.
[2] M. Bellare and P. Rogaway. Optimal Asymmetric Encryption - How to
Encrypt with RSA. In Advances in Cryptology-Eurocrypt '94, pp.
92-111, Springer-Verlag, 1994.
[3] M. Bellare and P. Rogaway. The Exact Security of Digital
Signatures - How to Sign with RSA and Rabin. In Advances in
Cryptology-Eurocrypt '96, pp. 399-416, Springer-Verlag, 1996.
[4] D. Bleichenbacher. Chosen Ciphertext Attacks against Protocols
Based on the RSA Encryption Standard PKCS #1. To appear in
Advances in Cryptology-Crypto '98.
[5] D. Bleichenbacher, B. Kaliski and J. Staddon. Recent Results on
PKCS #1: RSA Encryption Standard. RSA Laboratories' Bulletin,
Number 7, June 24, 1998.
[6] CCITT. Recommendation X.509: The Directory-Authentication
Framework. 1988.
[7] D. Coppersmith, M. Franklin, J. Patarin and M. Reiter. Low-
Exponent RSA with Related Messages. In Advances in Cryptology-
Eurocrypt '96, pp. 1-9, Springer-Verlag, 1996
[8] B. Den Boer and Bosselaers. Collisions for the Compression
Function of MD5. In Advances in Cryptology-Eurocrypt '93, pp
293-304, Springer-Verlag, 1994.
[9] B. den Boer, and A. Bosselaers. An Attack on the Last Two Rounds
of MD4. In Advances in Cryptology-Crypto '91, pp.194-203,
Springer-Verlag, 1992.
[10] H. Dobbertin. Cryptanalysis of MD4. Fast Software Encryption.
Lecture Notes in Computer Science, Springer-Verlag 1996, pp.
55-72.
[11] H. Dobbertin. Cryptanalysis of MD5 Compress. Presented at the
rump session of Eurocrypt `96, May 14, 1996
[12] H. Dobbertin.The First Two Rounds of MD4 are Not One-Way. Fast
Software Encryption. Lecture Notes in Computer Science,
Springer-Verlag 1998, pp. 284-292.
[13] J. Hastad. Solving Simultaneous Modular Equations of Low Degree.
SIAM Journal of Computing, 17, 1988, pp. 336-341.
[14] IEEE. IEEE P1363: Standard Specifications for Public Key
Cryptography. Draft Version 4.
[15] Kaliski, B., "The MD2 Message-Digest Algorithm", RFC1319, April
1992.
[16] National Institute of Standards and Technology (NIST). FIPS
Publication 180-1: Secure Hash Standard. April 1994.
[17] Rivest, R., "The MD5 Message-Digest Algorithm", RFC1321, April
1992.
[18] R. Rivest, A. Shamir and L. Adleman. A Method for Obtaining
Digital Signatures and Public-Key Cryptosystems. Communications
of the ACM, 21(2), pp. 120-126, February 1978.
[19] N. Rogier and P. Chauvaud. The Compression Function of MD2 is
not Collision Free. Presented at Selected Areas of Cryptography
`95. Carleton University, Ottawa, Canada. May 18-19, 1995.
[20] RSA Laboratories. PKCS #1: RSA Encryption Standard. Version 1.5,
November 1993.
[21] RSA Laboratories. PKCS #7: Cryptographic Message Syntax
Standard. Version 1.5, November 1993.
[22] RSA Laboratories. PKCS #8: Private-Key Information Syntax
Standard. Version 1.2, November 1993.
[23] RSA Laboratories. PKCS #12: Personal Information Exchange Syntax
Standard. Version 1.0, Work in Progress, April 1997.
Security Considerations
Security issues are discussed throughout this memo.
Acknowledgements
This document is based on a contribution of RSA Laboratories, a
division of RSA Data Security, Inc. Any substantial use of the text
from this document must acknowledge RSA Data Security, Inc. RSA Data
Security, Inc. requests that all material mentioning or referencing
this document identify this as "RSA Data Security, Inc. PKCS #1
v2.0".
Authors' Addresses
Burt Kaliski
RSA Laboratories East
20 Crosby Drive
Bedford, MA 01730
Phone: (617) 687-7000
EMail: burt@rsa.com
Jessica Staddon
RSA Laboratories West
2955 Campus Drive
Suite 400
San Mateo, CA 94403
Phone: (650) 295-7600
EMail: jstaddon@rsa.com
Full Copyright Statement
Copyright (C) The Internet Society (1998). All Rights Reserved.
This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published
and distributed, in whole or in part, without restriction of any
kind, provided that the above copyright notice and this paragraph are
included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of
developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be
followed, or as required to translate it into languages other than
English.
The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.