In the OAEP padding/armoring scheme for RSA encryption, the seed used is masked (with the masked data block) in the end. Why is that necessary, since the seed is random anyway?
$\begingroup$
$\endgroup$
5
-
$\begingroup$ When you say "masked" do you mean XORing the random seed with the output of the hash of the data block in the second Feistel round? $\endgroup$– pg1989Commented Apr 26, 2017 at 0:50
-
$\begingroup$ Yes, that's what I mean. $\endgroup$– matCommented Apr 26, 2017 at 11:32
-
2$\begingroup$ The OAEP proof wouldn't go through without it. The OAEP scheme is meant to be an all-or-nothing transform, but if the seed was not masked leaking it would allow recovery of individual message bits. $\endgroup$– pg1989Commented Apr 26, 2017 at 16:00
-
$\begingroup$ Could you elaborate on that, please. How is the unmasked seed in danger if beeing leaked? And how can that be used to recover message parts? My understanding of OAEP was, that it's purpose was to counter the Bleichenbacher attack by making the probability of a randim message being a valid padding negligible. $\endgroup$– matCommented Apr 26, 2017 at 18:37
-
1$\begingroup$ Answering this question satisfactorily will be difficult.. I understand just enough about RSA-OAEP proofs to tell they are highly technical. The original proof has been told incorrect; a stronger proof have been made, but I'm uncertain about if it is quantitatively sufficient to support common key sizes. $\endgroup$– fgrieu ♦Commented Apr 27, 2017 at 7:19
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
2
The point is that you will only be able to reconstruct the seed if you know every single bit of maskedSeed and maskedDB and you will be able to decode the message only if you know every single bit of the seed and maskedDB.
If an attacker gets only a single bit of maskedDB wrong, feeding it to the MGF will yield a totally different result and will not allow him to reconstruct the seed.
If only a single bit of maskedSeed is incorrect, the reconstructed seed will also contain a single incorrect bit and again, feeding it to the MGF will lead to a totally different value and it will not be possible to reconstruct the original message.
-
$\begingroup$ Reading your answer and resinspecting the scheme, I see now that a single flipped bit in the maskedDB would lead to a flipped bit in the message if the seed would not be masked. Is still don't understand how this would constitute an attack, though. $\endgroup$– matCommented Apr 23, 2019 at 14:54
-
$\begingroup$ The point is, that OAEP will add the all-or-nothing property to the encryption. You cannot take advantage of decrypting correctly only part of the encrypted message. A single incorrect bit is enough to turn the whole decoded message into garbage. $\endgroup$– dhe25519Commented Apr 25, 2019 at 7:30