Search code examples
.netsecurityencryptionsign

Do I use RSACryptoServiceProvider.SignHash to sign data?


Silly question but IIRC RSA can only encrypt a limited amount of bits based on its keysize. An asymmetric cypher can encrypt much more with the same key length (and runs faster). In that case can I sign only a limited amount of bits with RSACryptoServiceProvider.SignHash? or is it ok to use when signing and I don't need to use AES to sign it? (which I could do as the content is encrypted with AES).


Solution

  • RSA can indeed only encrypt a limited amount of data. A symmetric cipher can encrypt much more with a much smaller key length and does indeed run faster (given a modern cipher).

    You can only sign a limited amount of data using SignHash indeed. The method only expects you to deliver the bytes of the hash over the data, which is always relatively small, say about 16 to 64 bytes (MD5 to SHA512). An RSA key/modulus size is normally much larger, even RSA 1024 is already 128 bytes in size, although you need to subtract quite some padding overhead from that number.

    You don't normally use AES to sign. Signing with a symmetric cipher is called MAC'ing, but for signatures RSA is paired with a hash algorithm as above.

    In your case I would try and read a bit more about cryptography, and I would keep to the samples given for the specific library.