I\'d like to understand what is the meaning of this field, especially considerin

Question

I'd like to understand what is the meaning of this field, especially considering that when calling a crypto library to sign data the digest method is specified by the caller. For example, this simple C# code:

RSACryptoServiceProvider rcsp = certs[0].PrivateKey as RSACryptoServiceProvider;
rcsp.SignData(data, "SHA256");

Why would I even specify the algorithm if it's dictated by the certificate? And what is the meaning of the resulting signature in the above code, if say, the signature hash algorithm in the certificate is sha1 and not sha256?

Explanation / Answer

A typical X.509 certificate is the combination of data (including a public key PubB), and of a signature SigA of that data, to be verified with an unrelated public key PubA. In order for the verifier to know which hash to use when verifying SigA, there is use for a field in said data specifying the hash used by SigA, and that's the purpose of signatureAlgorithm in said data. As RFC 3279 puts it:

Certificates and CRLs conforming to RFC 3280 may be signed with any public key signature algorithm. The certificate or CRL indicates the algorithm through an algorithm identifier which appears in the signatureAlgorithm field within the Certificate or CertificateList.

The signatures that will be verified with PubB (produced with the corresponding private key by the certificate holder) use a hash (in your case, SHA-256) that may be different from the one used by PubA.

The signatureAlgorithm field remains useful after the signature SigA is verified, since the trust we can have in PubB, and in anything signed using PubB, depends on how much we trust that hash.

Note: typical security "proofs" for digital signatures silently assume that a single hash is used in conjunction with a given key, and that the verifier knows which. It would therefore make a lot of sense that a certificate introduces PubB only on the condition that it used to verify signatures in conjunction with a specified hash, or/and that by default that hash defaults to what was used in the certificate and is indicated by signatureAlgorithm; and I'm ready to bet that some PKIs using the X.509 certificate format do this.

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.