RSA Sign

Category: Asymmetric & Elliptic Curve · Node Type ID: asymmetric-rsa-sign

Creates digital signature using RSA-PSS or PKCS#1 v1.5 with private key

Overview

Hashes an input message with the selected Hash Algorithm (SHA-256, SHA-384, or SHA-512) and computes a digital signature using the signer's RSA private key under either RSA-PSS (Probabilistic Signature Scheme, RFC 8017 §8.1) or RSASSA-PKCS1-v1_5 (deterministic PKCS#1 v1.5 signature, RFC 8017 §8.2).

When Signature Scheme = PSS, the PSS Salt Length (Bytes) parameter is visible and controls the byte length of the random salt mixed into the EMSA-PSS encoding.

When to Use

Signing messages, certificates, JWT RS256/PS256 tokens, or firmware packages with an RSA private key.
Comparing probabilistic RSA-PSS signatures against deterministic RSASSA-PKCS1-v1_5 signatures.

Parameter Configuration

Parameter (ID)	Type & Default	Visibility Condition	Description & Options
Signature Scheme `scheme`	`select` Default: `PSS`	Always visible	Selects `PSS` (probabilistic EMSA-PSS, recommended for new protocols) or `PKCS1-v1_5` (deterministic ASN.1 DigestInfo PKCS#1 v1.5). `PSS`: RSA-PSS (Probabilistic Signature Scheme - RFC 8017) `PKCS1-v1_5`: RSASSA-PKCS1-v1_5 (Deterministic - PKCS#1 v1.5)
Hash Algorithm `hash`	`select` Default: `SHA-256`	Always visible	Cryptographic hash function applied to the input `Message` before signing (`SHA-256`, `SHA-384`, or `SHA-512`). `SHA-256`: SHA-256 `SHA-384`: SHA-384 `SHA-512`: SHA-512
PSS Salt Length (Bytes) `saltLength`	`number` Default: `32` Supports Variable Reference (`$var`: `int`)	When `scheme` is `PSS`	Byte length of the random salt used in RSA-PSS (clamped to `0..128`; default `32` to match SHA-256). Only visible when `Signature Scheme = PSS`.

Port I/O Specification

See Ports & Connections for general wiring rules, data type colors, and dynamic port creation.

Input Ports

Port Nature: Fixed Input Ports (2 total).

Port Name	Port ID	Data Type	Required	Visibility Condition	Description
`Private Key`	`privateKey`	`Any` (PEM/DER)	Required	Always visible	Signer RSA private key (accepts binary DER `Bytes` or UTF-8 PEM `Bytes`).
`Message`	`data`	`Bytes`	Required	Always visible	Raw message bytes (`Uint8Array`) to sign (automatically hashed by the node using the selected Hash Algorithm).

Output Ports

Port Nature: Fixed Output Ports (1 total).

Port Name	Port ID	Data Type	Visibility Condition	Description
`Signature`	`signature`	`Bytes`	Always visible	Computed RSA signature (`Uint8Array`, byte length equal to the RSA modulus size $k$).

Error Cases

When any of the following conditions occurs at runtime, this node transitions to an ERROR state and downstream nodes connected to its outputs do not execute.

Error Code	Default Engine Message	Trigger Condition
`INVALID_KEY_FORMAT`	Invalid RSA key format	Raised when the RSA public or private key cannot be parsed as valid PEM or ASN.1 DER key material.
`RSA_SIGN_FAILED`	RSA signature generation failed	Raised when RSA signature generation fails (e.g., modulus too small for the selected hash and PSS salt length).

Examples

Signing a Message with RSA-PSS (SHA-256)

Produce a 256-byte RSA-PSS signature using a 2048-bit RSA private key.

Leave Signature Scheme at RSA-PSS, Hash Algorithm at SHA-256, and PSS Salt Length at 32.
Connect Private Key (DER) from RSA KeyGen to Private Key and your message bytes to Message.