I'm looking at two major RSA encryption standards:

The second one can use different hashing functions to create a hash of encoding parameters and then verify the hash at decoding step. PKCS 1.5 doesn't have this additional integrity check, and that's why security wise it's inferior to RSA OAEP/SHA1 and RSA OAEP/SHA256.

Is there a significant difference between latter two from a security point of view? How the fact that SHA1 has a collision problem can be practically exploited here? Can this SHA1 vulnerability be used, e.g. to facilitate known plain text attacks?

My impression is that using SHA1 is secure here, just like in PBKDF2/HMAC-SHA1 cases, but please share your thoughts.

  • 1
    $\begingroup$ So in the OAEP security proofs (eg this one (PDF)) people usually assume the hash function(s) to be random oracles, a questionable assumption for SHA-1 these days (and slightly less so for SHA-2 as it exposes length extension attacks which ROs don't have). $\endgroup$
    – SEJPM
    May 9 '19 at 22:23
  • $\begingroup$ @SEJPM, yes, but it seems to be random enough for this case. PKCS#1.5 doesn't have encoding param verification at all, and is still considered safe enough. The qs really is: how SHA1 weakness can be exploited in OAEP case? I could envision somebody spoofing the input and decoder taking it as valid, but can it lead to uncovering the data? How if it can? $\endgroup$
    – Oleg Gryb
    May 9 '19 at 22:30
  • $\begingroup$ I don't believe OAEP relies on strong collision resistance from the hash. $\endgroup$
    – forest
    May 10 '19 at 0:29
  • 1
    $\begingroup$ In my opinion it's better to avoid all use of SHA1 (or other broken functions) in any cryptographic system, even where that use would be safe. The reason is that it increases the amount of code needed (and the overall code complexity) which could lead to unrelated vulnerabilities. Keep It Simple, Stupid! $\endgroup$ May 10 '19 at 1:31
  • $\begingroup$ @forest, yes that was my feeling as well. I just want somebody to confirm it by providing more details, e.g. attacker creates an encoded message with the same hash, but with different encoding parameters, which is possible due SHA1 weakness. How this can be exploited further? $\endgroup$
    – Oleg Gryb
    May 10 '19 at 16:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.