2
$\begingroup$

I'm new in cryptography and there are a couple of things that i'm not sure if i understand correctly.

First, when using padding (PKCS or OAEP), if the chiphertext has errors in transmission we'll we always get an error at the decyption process? Will it detect all errors, or is there a possibility that a certain combination of errors will result in a decryption but with a false result in plaintext?

Second, if no padding is used, (i believe it is called vanilla rsa?) and there are errors on the ciphertext, then the decryption will work any time but will give wrong results instead of the original encrypted plaintext?

Finally with padding or not, with no errors on ciphertext and by using a wrong private key will we get an error in decryption or just a false decrypted plaintext?

Improve this question
$\endgroup$
4
  • $\begingroup$ Note: If you use the Carmichael function $\lambda(n)$ instead of the Euler totient function $\varphi(n)$ to compute $d$ from $e$ these two $d$ values may be different, but decryptions works with both of them. $\endgroup$
    – gammatester
    Feb 19, 2016 at 10:05
  • $\begingroup$ I think that last sentence is basically a repeat of what you said in the second section of the question. Would it be a good idea to remove it? $\endgroup$
    – Maarten Bodewes ♦
    Feb 19, 2016 at 11:51
  • $\begingroup$ It is similar but not quite. This senario has no errors on ciphertext but a false private key. $\endgroup$
    – alf
    Feb 19, 2016 at 12:32
  • $\begingroup$ With the public key, it's easy to make a ciphertext that's accepted by the decryption process. Thus not all errors can be detected. $\endgroup$
    – fgrieu ♦
    Dec 27, 2020 at 9:37

1 Answer 1

Reset to default
3
$\begingroup$

First, when using padding (PKCS or OAEP), if the chiphertext has errors in transmission we'll we always get an error at the decyption process?

Yes, with extremely high probability. This is basically a chosen ciphertext attack and RSA-OAEP is fully immune to them, so the odds that you won't detect this attack (a.k.a. "error") are extremely low (below $2^{-128}$).

Will it detect all errors, or is there a possibility that a certain combination of errors will result in a decryption but with a false result in plaintext?

This is possible but extremely unlikely, again due to the IND-CCA2 security of RSA-OAEP.

Second, if no padding is used, (i believe it is called vanilla rsa?) and there are errors on the ciphertext, then the decryption will work any time but will give wrong results instead of the original encrypted plaintext?

Sometimes it's called "textbook RSA", "plain RSA" or "unpadded RSA".
If you follow the textbook RSA description, any errors will change the value of the ciphertext, resulting in a different number being decoded, resulting in an (unrelated) decryption, which will always work. If the error is malicious it could be exploited, depending on the reaction of the system.

Finally with padding or not, with no errors on ciphertext and by using a wrong private key will we get an error in decryption or just a false decrypted plaintext?

If you use a wrong private key $d$, which, by definition, doesn't satisfy $ed\equiv 1 \pmod{\lambda(n)}$, you'll decrypt a wrong message, which will lead to a verification error for OAEP and to a simple wrong message for unpadded RSA.

Improve this answer
$\endgroup$
3
  • $\begingroup$ Thank you for the detailed responce. Only one more clarification on the first question. Only OAEP is using IND-CCA2 and is capable of detecting all errors in ciphertext, or is there a version of PKCS that can too? $\endgroup$
    – alf
    Feb 20, 2016 at 9:36
  • $\begingroup$ @alf IND-CCA2 is a property of RSA-OAEP (= it resists all chosen ciphertext attacks). OAEP is actually the currently recommended encryption mode in PKCS#1 v2 (and more recent versions). The old PKCS#1 v1.5 schemes either weren't secure (no padding) or could be broken. $\endgroup$
    – SEJPM
    Feb 20, 2016 at 19:39
  • $\begingroup$ First question is related to channel coding. If channel is too noisy, Symbols has error and can't recreate bitstream properly. So, before it reaches to application layer, packet will be rejected by lower layers. Now let's say if error correction by other layers are not accurate (extremely less likely) , and it reaches to decryptor, then it up the the encryption scheme to reject. In standard encryption scheme it will reject and send error response. $\endgroup$
    – SSA
    Dec 29, 2020 at 13:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.