RSA

RSA

The CA SHALL use one of the following signature algorithms and encodings. When encoded, the AlgorithmIdentifier MUST be byte-for-byte identical with the specified hex-encoded bytes.

CA 應（SHALL）使用下列簽章演算法及編碼之一。編碼時，AlgorithmIdentifier 應（MUST）與指定的十六進位編碼位元組逐位元組完全相同。

• RSASSA-PKCS1-v1_5 with SHA-256:

  Encoding:

  300d06092a864886f70d01010b0500.

• 採用 SHA-256 的 RSASSA-PKCS1-v1_5：

  編碼：300d06092a864886f70d01010b0500。

• RSASSA-PKCS1-v1_5 with SHA-384:

  Encoding:

  300d06092a864886f70d01010c0500.

• 採用 SHA-384 的 RSASSA-PKCS1-v1_5：

  編碼：300d06092a864886f70d01010c0500。

• RSASSA-PKCS1-v1_5 with SHA-512:

  Encoding:

  300d06092a864886f70d01010d0500.

• 採用 SHA-512 的 RSASSA-PKCS1-v1_5：

  編碼：300d06092a864886f70d01010d0500。

• RSASSA-PSS with SHA-256, MGF-1 with SHA-256, and a salt length of 32 bytes:

  Encoding:

  304106092a864886f70d01010a3034a00f300d0609608648016503040201
  0500a11c301a06092a864886f70d010108300d0609608648016503040201
  0500a203020120

• 採用 SHA-256 的 RSASSA-PSS、採用 SHA-256 的 MGF-1，以及 32 位元組的鹽值長度：

  編碼：

  304106092a864886f70d01010a3034a00f300d0609608648016503040201
  0500a11c301a06092a864886f70d010108300d0609608648016503040201
  0500a203020120

• RSASSA-PSS with SHA-384, MGF-1 with SHA-384, and a salt length of 48 bytes:

  Encoding:

  304106092a864886f70d01010a3034a00f300d0609608648016503040202
  0500a11c301a06092a864886f70d010108300d0609608648016503040202
  0500a203020130

• 採用 SHA-384 的 RSASSA-PSS、採用 SHA-384 的 MGF-1，以及 48 位元組的鹽值長度：

  編碼：

  304106092a864886f70d01010a3034a00f300d0609608648016503040202
  0500a11c301a06092a864886f70d010108300d0609608648016503040202
  0500a203020130

• RSASSA-PSS with SHA-512, MGF-1 with SHA-512, and a salt length of 64 bytes:

  Encoding:

  304106092a864886f70d01010a3034a00f300d0609608648016503040203
  0500a11c301a06092a864886f70d010108300d0609608648016503040203
  0500a203020140

• 採用 SHA-512 的 RSASSA-PSS、採用 SHA-512 的 MGF-1，以及 64 位元組的鹽值長度：

  編碼：

  304106092a864886f70d01010a3034a00f300d0609608648016503040203
  0500a11c301a06092a864886f70d010108300d0609608648016503040203
  0500a203020140

Until 2026-09-15, the CA MAY use the following signature algorithm and encoding if all of the following conditions are met:

於 2026-09-15 之前，若符合下列所有條件，CA 得（MAY）使用下列 SHA-1 簽章演算法及編碼：

• If used within a Certificate, such as the signatureAlgorithm field of a Certificate or the signature field of a TBSCertificate:

  • The new Certificate is a Root CA Certificate or Subordinate CA Certificate that is a Cross-Certificate; and,
  • There is an existing Certificate, issued by the same issuing CA Certificate, using the following encoding for the signature algorithm; and,
  • The existing Certificate has a serialNumber that is at least 64-bits long; and,
  • The only differences between the new Certificate and existing Certificate are one of the following:
    • A new subjectPublicKey within the subjectPublicKeyInfo, using the same algorithm and key size; and/or,
    • A new serialNumber, of the same encoded length as the existing Certificate; and/or
    • The new Certificate’s extKeyUsage extension is present, has at least one key purpose specified, and none of the key purposes specified are the id-kp-serverAuth (OID: 1.3.6.1.5.5.7.3.1) or the anyExtendedKeyUsage (OID: 2.5.29.37.0) key purposes; and/or
    • The new Certificate’s basicConstraints extension has a pathLenConstraint that is zero.

• 若用於憑證（例如憑證的 signatureAlgorithm 欄位或 TBSCertificate 的 signature 欄位）：

  • 新憑證為根憑證機構（Root CA）憑證，或屬於交互認證（Cross-Certificate）之下屬憑證機構（Subordinate CA）憑證；且，
  • 存在一張由相同簽發憑證機構憑證（issuing CA Certificate）所簽發，且簽章演算法使用下列 SHA-1 編碼的現有憑證；且，
  • 該現有憑證的 serialNumber 長度至少為 64 位元；且，
  • 新憑證與現有憑證之間的差異僅限於下列一項或多項：
    • subjectPublicKeyInfo 中有一個新的 subjectPublicKey，且使用相同的演算法與金鑰長度；及／或，
    • 有一個新的 serialNumber，其編碼長度與現有憑證相同；及／或，
    • 新憑證的 extKeyUsage 擴充欄位存在、至少指定一種金鑰適用目的（key purpose），且所指定之金鑰適用目的均非 id-kp-serverAuth（OID：1.3.6.1.5.5.7.3.1）或 anyExtendedKeyUsage（OID：2.5.29.37.0）；及／或，
    • 新憑證的 basicConstraints 擴充欄位之 pathLenConstraint 為零。

• If used within an OCSP response, such as the signatureAlgorithm of a BasicOCSPResponse:

  • The producedAt field value of the ResponseData MUST be earlier than 2022-06-01 00:00:00 UTC; and,
  • All unexpired, un-revoked Certificates that contain the Public Key of the CA Key Pair and that have the same Subject Name MUST also contain an extKeyUsage extension with the only key usage present being the id-kp-ocspSigning (OID: 1.3.6.1.5.5.7.3.9) key usage.

• 若用於 OCSP 回應（例如 BasicOCSPResponse 的 signatureAlgorithm）：

  • ResponseData 的 producedAt 欄位值應（MUST）早於 2022-06-01 00:00:00 UTC；且，
  • 所有未過期、未廢止、包含 CA 金鑰對（Key Pair）之公開金鑰（Public Key），且具有相同主體名稱（Subject Name）之憑證，應（MUST）亦包含 extKeyUsage 擴充欄位，且其中唯一存在的憑證金鑰用途（key usage）為 id-kp-ocspSigning（OID：1.3.6.1.5.5.7.3.9）。

• If used within a CRL, such as the signatureAlgorithm field of a CertificateList or the signature field of a TBSCertList:

  • The CRL is referenced by one or more Root CA or Subordinate CA Certificates; and,
  • The Root CA or Subordinate CA Certificate has issued one or more Certificates using the following encoding for the signature algorithm.

• 若用於 CRL（例如 CertificateList 的 signatureAlgorithm 欄位或 TBSCertList 的 signature 欄位）：

  • 該 CRL 被一張或多張根憑證機構（Root CA）憑證或下屬憑證機構（Subordinate CA）憑證所參照；且，
  • 該根憑證機構憑證或下屬憑證機構憑證已簽發一張或多張憑證，且已簽發憑證的簽章演算法使用下列 SHA-1 編碼。

Note: The above requirements do not permit a CA to sign a Precertificate with this encoding.

注意：上述規定不允許 CA 使用下列 SHA-1 編碼簽章預簽憑證。

• RSASSA-PKCS1-v1_5 with SHA-1:

  Encoding: 300d06092a864886f70d0101050500

• 採用 SHA-1 的 RSASSA-PKCS1-v1_5：

  編碼：300d06092a864886f70d0101050500

Prior to 2026-09-15, the CA SHALL revoke any unexpired Subordinate CA Certificate that contains RSASSA-PKCS1-v1_5 with SHA-1 within the Certificate.

於 2026-09-15 之前，CA 應（SHALL）廢止所有未過期且憑證中含有 RSASSA-PKCS1-v1_5 with SHA-1 之下屬憑證機構（Subordinate CA）憑證。