From 3367806cd464fac96abd1b8416700ad174e8b64d Mon Sep 17 00:00:00 2001 From: Marti Raudsepp Date: Sat, 30 Jun 2018 02:27:28 +0300 Subject: Add OID for RSASSA-PSS X.509 signature algorithm (RFC 4055) (#4294) In 2005, IETF devised a more secure padding scheme to replace PKCS #1 v1.5. To make sure that nobody can easily support or use it, they mandated lots of complicated parameters in the certificate, unlike any other X.509 signature scheme. https://tools.ietf.org/html/rfc4055 `_SIG_OIDS_TO_HASH` and `Certificate.signature_hash_algorithm` cannot be supported as-is, because the hash algorithm is defined in the signature algorithm parameters, not by the OID itself. --- docs/x509/reference.rst | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'docs') diff --git a/docs/x509/reference.rst b/docs/x509/reference.rst index 7a41e1f3..3fc6507e 100644 --- a/docs/x509/reference.rst +++ b/docs/x509/reference.rst @@ -2569,6 +2569,15 @@ instances. The following common OIDs are available as constants. Corresponds to the dotted string ``"1.2.840.113549.1.1.13"``. This is a SHA512 digest signed by an RSA key. + .. attribute:: RSASSA_PSS + + .. versionadded:: 2.3 + + Corresponds to the dotted string ``"1.2.840.113549.1.1.10"``. This is + signed by an RSA key using the Probabilistic Signature Scheme (PSS) + padding from RFC 4055. The hash function and padding are defined by + signature algorithm parameters. + .. attribute:: ECDSA_WITH_SHA1 Corresponds to the dotted string ``"1.2.840.10045.4.1"``. This is a SHA1 -- cgit v1.2.3