I'm doing vulnerability research and looking at a device that is using some u-boot RSA encryption that they've modified. I've extracted the 4096-bit public key from the flash, it has an exponent of
65537. They simplified the padding to use a hardcoded 480-byte array that's labeled as
"PKCS 1.5 paddings as described in the RSA PKCS#1 v2.1 standard"
[ 0x00, 0x01, (458 * 0xFF), 0x00, 0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20 ]
I have the source code for verifying the signature and doing a
memcmp on the padding and the sha256 hash. I can recreate the decomp byte-for-byte and create any kind of padding oracle that I would need. I don't have any known ciphertext, unfortunately.
It's probably obvious to most of you but crypto isn't my strong suit. I've successfully done some AES CBC-mode bit flip attacks previously. I'm trying to learn and improve though. I'm looking for guidance in any research material that can help me understand if there is a potential vulnerability here.
I'm interested in being able to forge a signature if possible but almost all of the reference material I've found is only applicable when the exponent is
I did find this previous post (https://crypto.stackexchange.com/a/27512) that linked to some white papers on fixed padding.