3
$\begingroup$

The RSA encryption padding of RSAES-OAEP has a lHash field set to the hash of a label. That label is typically the empty string, or some public description of the intended use of the message.

OAEP

Does the lHash field play some role in the security (confidentiality of M under IND-CCA2 or similar), or security reduction to RSA? Does that depend on lHash being checked on decryption? On lHash not leaking on decryption of malformed cryptograms?

Would removing lHash and accordingly increasing the maximum size of M harm security?


Update: Squeamish Ossifrage answers, essentially by yes. Accordingly, PKCS#1v2.2's EME-OAEP decoding wants lHash to be checked, as well as other padding, and that it be done in constant time:

Care must be taken to ensure that an opponent cannot distinguish the different error conditions [on 00, lHash, PS, 01], whether by error message or timing, or, more generally, learn partial information about the encoded message EM. Otherwise an opponent may be able to obtain useful information about the decryption of the ciphertext C, leading to a chosen-ciphertext attack such as the one observed by Manger [35].

James Manger's A Chosen Ciphertext Attack on RSA Optimal Asymmetric Encryption Padding (OAEP) as Standardized in PKCS #1 v2.0, in proceedings of Crypto 2001, essentially shows that decryption implementations leaking if the leading 00 is present can be converted into a decryption oracle.

$\endgroup$
  • $\begingroup$ Humph. Now I feel ridiculous for citing the security reduction and not Manger's paper. I even cited Manger's paper just the other day in another context. $\endgroup$ – Squeamish Ossifrage Dec 17 '17 at 15:50
  • $\begingroup$ @SqueamishOssifrage: I'm ridiculous for not remembering Manger's paper in the first place! $\endgroup$ – fgrieu Dec 17 '17 at 15:54
  • $\begingroup$ We may need a neutral third-party arbiter to decide which of us is more ridiculous at this point. $\endgroup$ – Squeamish Ossifrage Dec 17 '17 at 16:03
4
$\begingroup$

I believe $\mathit{lHash} \mathbin\Vert \mathit{PS} \mathbin\Vert \mathrm{01}$ serves the rôle of the zero-padding in $s = (m \mathbin\Vert 0^{k_1}) \oplus G(r)$ from the formulation of RSAES-OAEP in the standard reference for its security reduction, on p. 5. Verifying that it matches exactly what you intend is critical for the security reduction to work, in particular where it figures into Game 6 on p. 14, to provide the bounds involving $k_1$ in Theorem 1 on p. 9.

Using a label perhaps provides some kind of domain separation for different applications, in case, e.g., two application's entropy sources are both broken.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.