The following errors may occur during SBOM signing.
Error message
SHA3 hash algorithm signing is not supported for RSA keysDescription
Your in-toto sign command is attempting to use a SHA3 algorithm with an RSA key. SHA3 SBOM signing is currently only supported for ECDSA keypair.
Solution
There are two solutions to this error:
To sign using SHA3, specify a ECDSA keypair in the sign command.
To sign with your RSA keypair, select an alternative algorithm in the sign command.
Error message
crypto/rsa: unsupported hash functionDescription
Your in-toto sign verify command is attempting to use a SHA3 algorithm with an RSA key. SHA3 SBOM verification is currently only supported for ECDSA keypair.
Solution
There are two solutions to this error:
To sign and then verify a signed SBOM using SHA3, specify a ECDSA keypair in the verify command.
To sign and then verify a signed SBOM with your RSA keypair, select an alternative algorithm in the verify command.