If I implement EMSA-PKCS1-v1_5 in the following two non-standard ways, what kind of things could go wrong?

The padding structure will be referred as (00|01|PS|00|DER(Digest Algo)|Digest), where | is concatenation and DER is DER encoding of an ASN.1 value of type DigestInfo:

DigestInfo ::= SEQUENCE {
  digestAlgorithm AlgorithmIdentifier,
  digest OCTET STRING}
  1. I encode the structure as (00|xx|PS|00|DER(Digest Algo)|Digest) which means that I stored some data in the xx field (e.g., xx can be 01, 02, 03, 04). And I will check the xx value during the PKCS padding check, i.e., the xx value is also passed as plaintext for me to check against the ones in the encoding.

  2. The digest is normally created using SHA-1 hash of data, e.g., Digest=SHA1(data). However, I split the data into data0 and data1 and create SHA1(data0) and SHA1(data1). So the Digest=SHA1(data0)|SHA1(data1).

  • 1
    $\begingroup$ The standard structure doesn't end with DER(DigestAlgo)|Digest (is DigestAlgo an AlgorithmIdentifer or just an OID?) but rather as you quote DER(SEQ{AlgorithmIdentifier,digest OCTETSTRING}) which happens to include the digest value as the last N bytes. The difference is the standard has tag&length for the outer SEQ, for the AlgId and the components of the AlgId, and for the digest, which does amount to a fixed prefix before the digest value, whereas your form would only have them for the DigestAlgo part. $\endgroup$ – dave_thompson_085 Jan 20 '15 at 23:40
  • 1
    $\begingroup$ It should go without saying that your changes would not interoperate successfully with implementations that follow the standard. Do you count that as "going wrong", or do you care only about security vulnerabilities that would occur if all relevant parties used your scheme(s)? I think the latter is ontopic here, but the former might belong on Security.SE $\endgroup$ – dave_thompson_085 Jan 20 '15 at 23:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.