The parameters MUST be present when used in the algorithm identifier
associated with an encrypted value.
id-RSAES-OAEP OBJECT IDENTIFIER ::= { pkcs-1 7 }
RSAES-OAEP-params ::= SEQUENCE {
hashFunc [0] AlgorithmIdentifier DEFAULT
sha1Identifier,
maskGenFunc [1] AlgorithmIdentifier DEFAULT
mgf1SHA1Identifier,
pSourceFunc [2] AlgorithmIdentifier DEFAULT
pSpecifiedEmptyIdentifier }
pSpecifiedEmptyIdentifier AlgorithmIdentifier ::=
{ id-pSpecified, nullOctetString }
nullOctetString OCTET STRING (SIZE (0)) ::= { ’’H }
The fields of type RSAES-OAEP-params have the following meanings:
hashFunc
The hashFunc field identifies the one-way hash function. It
MUST be one of the algorithm identifiers listed in Section 2.1,
and the default hash function is SHA-1. Implementations MUST
support SHA-1 and MAY support other one-way hash functions
listed in Section 2.1. Implementations that perform encryption
MUST omit the hashFunc field when SHA-1 is used, indicating
that the default algorithm was used. Implementations that
perform decryption MUST recognize both the sha1Identifier
algorithm identifier and an absent hashFunc field as an
indication that SHA-1 was used.
maskGenFunc
The maskGenFunc field identifies the mask generation function.
The default mask generation function is MGF1 with SHA-1. For
MGF1, it is strongly RECOMMENDED that the underlying hash
function be the same as the one identified by hashFunc.
Implementations MUST support MGF1. MGF1 requires a one-way
hash function that is identified in the parameter field of the
MGF1 algorithm identifier. Implementations MUST support SHA-1
and MAY support any of the other one-way hash functions listed
in Section 2.1. The MGF1 algorithm identifier is comprised of
the id-mgf1 object identifier and a parameter that contains the
algorithm identifier of the one-way hash function employed with
MGF1. The SHA-1 algorithm identifier is comprised of the id-
sha1 object identifier and an (optional) parameter of NULL.
Implementations that perform encryption MUST omit the
maskGenFunc field when MGF1 with SHA-1 is used, indicating that
the default algorithm was used.
Although mfg1SHA1Identifier is defined as the default value for
this field, implementations MUST accept both the default value
encoding (i.e., an absent field) and the mfg1SHA1Identifier to
be explicitly present in the encoding.
pSourceFunc
The pSourceFunc field identifies the source (and possibly the
value) of the encoding parameters, commonly called P.
Implementations MUST represent P by an algorithm identifier,
id-pSpecified, indicating that P is explicitly provided as an
OCTET STRING in the parameters. The default value for P is an
empty string. In this case, pHash in EME-OAEP contains the
hash of a zero length string. Implementations MUST support a
zero length P value. Implementations that perform encryption
MUST omit the pSourceFunc field when a zero length P value is
used, indicating that the default value was used.
Implementations that perform decryption MUST recognize both the
id-pSpecified object identifier and an absent pSourceFunc field
as an indication that a zero length P value was used.
Implementations that perform decryption MUST support a zero
length P value and MAY support other values. Compliant
implementations MUST NOT use any value other than id-pSpecified
for pSourceFunc.
If the default values of the hashFunc, maskGenFunc, and pSourceFunc
fields of RSAES-OAEP-params are used, then the algorithm identifier
will have the following value:
rSAES-OAEP-Default-Identifier AlgorithmIdentifier ::=
{ id-RSAES-OAEP,
rSAES-OAEP-Default-Params }
rSAES-OAEP-Default-Params RSASSA-OAEP-params ::=
{ sha1Identifier,
mgf1SHA1Identifier,
pSpecifiedEmptyIdentifier }
5. PKCS #1 Version 1.5 Signature Algorithm
RFC 2313 [P1v1.5] specifies the PKCS #1 Version 1.5 signature
algorithm. This specification is also included in PKCS #1 Version
2.1 [P1v2.1]. RFC 3279 [PKALGS] specifies the use of the PKCS #1
Version 1.5 signature algorithm with the MD2, MD5, and the SHA-1
one-way hash functions. This section specifies the algorithm
identifiers for using the SHA-224, SHA-256, SHA-384, and SHA-512
one-way hash functions with the PKCS #1 version 1.5 signature
algorithm.
The RSASSA-PSS signature algorithm is preferred over the PKCS #1
Version 1.5 signature algorithm. Although no attacks are known
against PKCS #1 Version 1.5 signature algorithm, in the interest of
increased robustness, RSASSA-PSS signature algorithm is recommended
for eventual adoption, especially by new applications. This section
is included for compatibility with existing applications, and while
still appropriate for new applications, a gradual transition to the
RSASSA-PSS signature algorithm is encouraged.
The PKCS #1 Version 1.5 signature algorithm with these one-way hash
functions and the RSA cryptosystem is implemented using the padding
and encoding conventions described in RFC 2313 [P1v1.5].
The message digest is computed using the SHA-224, SHA-256, SHA-384,
or SHA-512 one-way hash function.
The PKCS #1 version 1.5 signature algorithm, as specified in RFC
2313, includes a data encoding step. In this step, the message
digest and the object identifier for the one-way hash function used
to compute the message digest are combined. When performing the data
encoding step, the id-sha224, id-sha256, id-sha384, and id-sha512
object identifiers (see Section 2.1) MUST be used to specify the
SHA-224, SHA-256, SHA-384, and SHA-512 one-way hash functions,
respectively.
The object identifier used to identify the PKCS #1 version 1.5
signature algorithm with SHA-224 is:
sha224WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 14 }
The object identifier used to identify the PKCS #1 version 1.5
signature algorithm with SHA-256 is:
sha256WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 11 }
The object identifier used to identify the PKCS #1 version 1.5
signature algorithm with SHA-384 is:
sha384WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 12 }
The object identifier used to identify the PKCS #1 version 1.5
signature algorithm with SHA-512 is:
sha512WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 13 }
When any of these four object identifiers appears within an
AlgorithmIdentifier, the parameters MUST be NULL. Implementations
MUST accept the parameters being absent as well as present.
The RSA signature generation process and the encoding of the result
are described in detail in RFC 2313 [P1v1.5].
6. ASN.1 Module
PKIX1-PSS-OAEP-Algorithms
{ iso(1) identified-organization(3) dod(6)
internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)
id-mod-pkix1-rsa-pkalgs(33) }
DEFINITIONS EXPLICIT TAGS ::= BEGIN
-- EXPORTS All;
IMPORTS
AlgorithmIdentifier
FROM PKIX1Explicit88 -- Found in [PROFILE]
{ iso(1) identified-organization(3) dod(6) internet(1)
security(5) mechanisms(5) pkix(7) id-mod(0)
id-pkix1-explicit(18) } ;
-- ============================
-- Basic object identifiers
-- ============================
pkcs-1 OBJECT IDENTIFIER ::= { iso(1) member-body(2)
us(840) rsadsi(113549) pkcs(1) 1 }
-- When rsaEncryption is used in an AlgorithmIdentifier the
-- parameters MUST be present and MUST be NULL.
rsaEncryption OBJECT IDENTIFIER ::= { pkcs-1 1 }
-- When id-RSAES-OAEP is used in an AlgorithmIdentifier,
-- and the parameters field is present, it MUST be
-- RSAES-OAEP-params
id-RSAES-OAEP OBJECT IDENTIFIER ::= { pkcs-1 7 }
-- When id-pSpecified is used in an AlgorithmIdentifier the
-- parameters MUST be an OCTET STRING.
id-pSpecified OBJECT IDENTIFIER ::= { pkcs-1 9 }
-- When id-RSASSA-PSS is used in an AlgorithmIdentifier, and the
-- parameters field is present, it MUST be RSASSA-PSS-params.
id-RSASSA-PSS OBJECT IDENTIFIER ::= { pkcs-1 10 }
-- When id-mgf1 is used in an AlgorithmIdentifier the parameters
-- MUST be present and MUST be a HashAlgorithm.
id-mgf1 OBJECT IDENTIFIER ::= { pkcs-1 8 }
-- When the following OIDs are used in an AlgorithmIdentifier, the
-- parameters MUST be present and MUST be NULL.
sha224WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 14 }
sha256WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 11 }
sha384WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 12 }
sha512WithRSAEncryption OBJECT IDENTIFIER ::= { pkcs-1 13 }
-- When the following OIDs are used in an AlgorithmIdentifier the
-- parameters SHOULD be absent, but if the parameters are present,
-- they MUST be NULL.
id-sha1 OBJECT IDENTIFIER ::= { iso(1)
identified-organization(3) oiw(14)
secsig(3) algorithms(2) 26 }
id-sha224 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2)
country(16) us(840) organization(1) gov(101)
csor(3) nistalgorithm(4) hashalgs(2) 4 }
id-sha256 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2)
country(16) us(840) organization(1) gov(101)
csor(3) nistalgorithm(4) hashalgs(2) 1 }
id-sha384 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2)
country(16) us(840) organization(1) gov(101)
csor(3) nistalgorithm(4) hashalgs(2) 2 }
id-sha512 OBJECT IDENTIFIER ::= { joint-iso-itu-t(2)
country(16) us(840) organization(1) gov(101)
csor(3) nistalgorithm(4) hashalgs(2) 3 }
-- =============
-- Constants
-- =============
nullOctetString OCTET STRING (SIZE (0)) ::= ’’H
nullParameters NULL ::= NULL
-- =========================
-- Algorithm Identifiers
-- =========================
sha1Identifier AlgorithmIdentifier ::= {
algorithm id-sha1,
parameters nullParameters }
sha224Identifier AlgorithmIdentifier ::= {
algorithm id-sha224,
parameters nullParameters }
sha256Identifier AlgorithmIdentifier ::= {
algorithm id-sha256,
parameters nullParameters }
sha384Identifier AlgorithmIdentifier ::= {
algorithm id-sha384,
parameters nullParameters }
sha512Identifier AlgorithmIdentifier ::= {
algorithm id-sha512,
parameters nullParameters }
mgf1SHA1Identifier AlgorithmIdentifier ::= {
algorithm id-mgf1,
parameters sha1Identifier }
mgf1SHA224Identifier AlgorithmIdentifier ::= {
algorithm id-mgf1,
parameters sha224Identifier }
mgf1SHA256Identifier AlgorithmIdentifier ::= {
algorithm id-mgf1,
parameters sha256Identifier }
mgf1SHA384Identifier AlgorithmIdentifier ::= {
algorithm id-mgf1,
parameters sha384Identifier }
mgf1SHA512Identifier AlgorithmIdentifier ::= {
algorithm id-mgf1,
parameters sha512Identifier }
pSpecifiedEmptyIdentifier AlgorithmIdentifier ::= {
algorithm id-pSpecified,
parameters nullOctetString }
rSASSA-PSS-Default-Params RSASSA-PSS-params ::= {
hashAlgorithm sha1Identifier,
maskGenAlgorithm mgf1SHA1Identifier,
saltLength 20,
trailerField 1 }
rSASSA-PSS-Default-Identifier AlgorithmIdentifier ::= {
algorithm id-RSASSA-PSS,
parameters rSASSA-PSS-Default-Params }
rSASSA-PSS-SHA224-Identifier AlgorithmIdentifier ::= {
algorithm id-RSASSA-PSS,
parameters rSASSA-PSS-SHA224-Params }
rSASSA-PSS-SHA224-Params RSASSA-PSS-params ::= {
hashAlgorithm sha224Identifier,
maskGenAlgorithm mgf1SHA224Identifier,
saltLength 20,
trailerField 1 }
rSASSA-PSS-SHA256-Identifier AlgorithmIdentifier ::= {
algorithm id-RSASSA-PSS,
parameters rSASSA-PSS-SHA256-Params }
rSASSA-PSS-SHA256-Params RSASSA-PSS-params ::= {
hashAlgorithm sha256Identifier,
maskGenAlgorithm mgf1SHA256Identifier,
saltLength 20,
trailerField 1 }
rSASSA-PSS-SHA384-Identifier AlgorithmIdentifier ::= {
algorithm id-RSASSA-PSS,
parameters rSASSA-PSS-SHA384-Params }
rSASSA-PSS-SHA384-Params RSASSA-PSS-params ::= {
hashAlgorithm sha384Identifier,
maskGenAlgorithm mgf1SHA384Identifier,
saltLength 20,
trailerField 1 }
rSASSA-PSS-SHA512-Identifier AlgorithmIdentifier ::= {
algorithm id-RSASSA-PSS,
parameters rSSASSA-PSS-SHA512-params }
rSSASSA-PSS-SHA512-params RSASSA-PSS-params ::= {
hashAlgorithm sha512Identifier,
maskGenAlgorithm mgf1SHA512Identifier,
saltLength 20,
trailerField 1 }
rSAES-OAEP-Default-Params RSAES-OAEP-params ::= {
hashFunc sha1Identifier,
maskGenFunc mgf1SHA1Identifier,
pSourceFunc pSpecifiedEmptyIdentifier }
rSAES-OAEP-Default-Identifier AlgorithmIdentifier ::= {
algorithm id-RSAES-OAEP,
parameters rSAES-OAEP-Default-Params }
rSAES-OAEP-SHA224-Identifier AlgorithmIdentifier ::= {
algorithm id-RSAES-OAEP,
parameters rSAES-OAEP-SHA224-Params }
rSAES-OAEP-SHA224-Params RSAES-OAEP-params ::= {
hashFunc sha224Identifier,
maskGenFunc mgf1SHA224Identifier,
pSourceFunc pSpecifiedEmptyIdentifier }
rSAES-OAEP-SHA256-Identifier AlgorithmIdentifier ::= {
algorithm id-RSAES-OAEP,
parameters rSAES-OAEP-SHA256-Params }
rSAES-OAEP-SHA256-Params RSAES-OAEP-params ::= {
hashFunc sha256Identifier,
maskGenFunc mgf1SHA256Identifier,
pSourceFunc pSpecifiedEmptyIdentifier }
rSAES-OAEP-SHA384-Identifier AlgorithmIdentifier ::= {
algorithm id-RSAES-OAEP,
parameters rSAES-OAEP-SHA384-Params }
rSAES-OAEP-SHA384-Params RSAES-OAEP-params ::= {
hashFunc sha384Identifier,
maskGenFunc mgf1SHA384Identifier,
pSourceFunc pSpecifiedEmptyIdentifier }
rSAES-OAEP-SHA512-Identifier AlgorithmIdentifier ::= {
algorithm id-RSAES-OAEP,
parameters rSAES-OAEP-SHA512-Params }
rSAES-OAEP-SHA512-Params RSAES-OAEP-params ::= {
hashFunc sha512Identifier,
maskGenFunc mgf1SHA512Identifier,
pSourceFunc pSpecifiedEmptyIdentifier }
-- ===================
-- Main structures
-- ===================
-- Used in SubjectPublicKeyInfo of X.509 Certificate.
RSAPublicKey ::= SEQUENCE {
modulus INTEGER, -- n
publicExponent INTEGER } -- e
-- AlgorithmIdentifier parameters for id-RSASSA-PSS.
-- Note that the tags in this Sequence are explicit.
RSASSA-PSS-params ::= SEQUENCE {
hashAlgorithm [0] HashAlgorithm DEFAULT
sha1Identifier,
maskGenAlgorithm [1] MaskGenAlgorithm DEFAULT
mgf1SHA1Identifier,
saltLength [2] INTEGER DEFAULT 20,
trailerField [3] INTEGER DEFAULT 1 }
HashAlgorithm ::= AlgorithmIdentifier
MaskGenAlgorithm ::= AlgorithmIdentifier
-- AlgorithmIdentifier parameters for id-RSAES-OAEP.
-- Note that the tags in this Sequence are explicit.
RSAES-OAEP-params ::= SEQUENCE {
hashFunc [0] AlgorithmIdentifier DEFAULT
sha1Identifier,
maskGenFunc [1] AlgorithmIdentifier DEFAULT
mgf1SHA1Identifier,
pSourceFunc [2] AlgorithmIdentifier DEFAULT
pSpecifiedEmptyIdentifier }
END
7. References
7.1. Normative References
[P1v1.5] Kaliski, B., "PKCS #1: RSA Encryption Version 1.5",