Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Clarification on Allowed Signature Algorithms: RSASSA-PSS vs. RSASSA-PKCS-v1_5 #82

Open
uwsrf opened this issue Nov 16, 2024 · 0 comments

Comments

@uwsrf
Copy link

uwsrf commented Nov 16, 2024

In the C2PA Specifications version 2.1, there seems to be a discrepancy regarding the allowed signature algorithms:

In section 13.2.1., the listed signature algorithms include only RSASSA-PSS for RSA-based signatures.
However, in section 14.5.1.1., the examples refer to sha256WithRSAEncryption and similar signatures, which are defined in RFC 8017, Appendix A.2.4 describing RSASSA-PKCS-v1_5.
This raises the question:
Is RSASSA-PKCS-v1_5 also allowed alongside RSASSA-PSS, or should it be considered deprecated/unsupported?

Could you please clarify the intended scope of allowed RSA signature algorithms in the specifications?

Thank you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant