RSA-PSS(7SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

💖 RSA-PSS — the manual, but make it make sense 💖

okay so bestie, this is the page for RSA-PSS(7SSL) from the OpenSSL crew. it's short, it's sweet, it's lowkey iconic. let's get into it 🫶

✨ NAME ✨

RSA-PSS — the EVP_PKEY RSA-PSS algorithm support. that's the whole name, no notes 💅

🌸 DESCRIPTION 🌸

okay so picture the RSA algorithm but with ✨boundaries✨. the RSA-PSS EVP_PKEY implementation is a restricted version of RSA — it only supports:

  • signing,
  • verification,
  • and key generation,

and it does all of that using PSS padding modes, with optional parameter restrictions on top. it's giving "RSA but it went to therapy and learned to set limits" 😌

it also comes with its own associated private key and public key formats. yes queen, formats included 💖

and heads up: this algorithm shares several control operations with the RSA algorithm, but with some restrictions — those are spilled below, keep reading.

🔐 Signing and Verification

signing and verification works basically the same as plain RSA, except the padding mode is always PSS. always. no switching, no negotiating, periodt.

here's the cute part though: if the key you're using has parameter restrictions, then the corresponding signature parameters get set to match those restrictions. for example, if the key can only be used with:

  • digest SHA256,
  • MGF1 SHA256,
  • and minimum salt length 32,

then the digest, MGF1 digest and salt length will be set to SHA256, SHA256 and 32 respectively. the key said what it said and everything else falls in line 💅

🗝️ Key Generation

by default — no parameter restrictions are placed on the generated key. free-range key, roaming wild and free 🦋

📝 NOTES 📝

the public key format is documented in RFC4055. noted. if you want the full deets, that's where they live.

now, the PKCS#8 private key format used for RSA-PSS keys? it's similar to the RSA format, except:

  • it uses the id-RSASSA-PSS OID, and
  • the parameters field, if present, restricts the key parameters in the same way as the public key.

so same vibe, different OID, and possibly some restrictions riding along in that parameters field. iykyk 🌈

👑 CONFORMING TO 👑

RFC 4055

that's it. that's the standard. she conforms 🎀

🔥 SEE ALSO 🔥

go read these next, they're all part of the lore:

Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

fr fr read the license, bestie, it's not optional and it's not long 💅

and that's the whole page, no cap 🫶 this was RSA-PSS(7SSL) from OpenSSL, version 4.0.3, dated 2026-09-29 — go forth and sign things responsibly, mwah 💖✨🎀

📦 where this page comes from