Is Bypassing Padding Verification in RSA-PSS Dangerous?

Question

I am currently working on a project involving RSA-PSS (Probabilistic Signature Scheme) for digital signatures. While researching potential vulnerabilities, I came across the well-known Bleichenbacher attack, which primarily targets PKCS1 v1.5 padding.

My understanding is that the Bleichenbacher attack is not applicable to RSA-PSS due to the fact that the padding is involved in the calculation of final hash value before comparision. However, I'm curious about the security implications if one were to bypass the padding verification step in RSA-PSS.

Specifically:

Are there known vulnerabilities or attacks against RSA-PSS that can be exploited when the padding verification is intentionally bypassed?

How does this compare to the well-documented Bleichenbacher attack on PKCS1 v1.5?

Are there any real-world scenarios or practical risks associated with skipping the padding verification in RSA-PSS?

Answer 1

RSA based signature schemes generally fail badly when padding isn't verified. When the verifier checks the padding, each (salt,message) pair generates a single target integer t for which the attacker must find x such that (x^d)mod N = t. When padding is not checked t is no longer a single integer but rather a large set of integers since only some bits of t are checked.

If the public exponent is small (EG:d=3), an attacker can find an x that fits this equation to produce a t with the right bits in the right places.

In RSA-PSS the padding constrains most of the ciphertext bits. If not checked, only a small fraction of the bits (salt and hash) are constrained. The rest are free variables. This would make the scheme vulnerable to a classic Bleichenbacher attack.

https://en.wikipedia.org/wiki/Daniel_Bleichenbacher#BB'06_attack:_signature_forgery_attack_against_the_RSA_PKCS#1_signature_standard

Attack implementation details: https://words.filippo.io/bleichenbacher-06-signature-forgery-in-python-rsa/