> There is no security proof for PKCS#1 v1.5, it's probably safe As long as you avoid the known problems, it probably is safe for signatures and the main probl

> There is no security proof for PKCS#1 v1.5, it's probably safe As long as you avoid the known problems, it probably is safe for signatures and the main problem now is that PSS is not included in lots of standards which thus require PKCS1_1v5. This prevents major implementation due to those standards not being updated fast enough. As an example of slow adoption: The HSMs i'm currently using only started native support for PSS last year, about 20 years after it's introduction. Please note that pkcs1_1v5 is never secure for encryption/decryption schemes.