0
$\begingroup$

Lets's say I have a cipher-module / cryptography-service that signs a hash of some unknown payload.

What are the possible attacks that I would need to guard against in this context (primarily assuming RSA algorithm but it could also be EC-DSA algorithm)?

With regard to the RSA, to guard against chosen cipher-text attacks as noted here have come-up with the following scheme.

  1. Client calculates SHA-256 hash of payload.
  2. Client sends hash to server for timestamping.
  3. Server receives hash, generates a nonce.
  4. Server concatenates nonce (server-generated-random) and the hash (client-input) and calculates hash on the concatenated string.
  5. Server signs the hash that it calculated and returns the signature and the nonce back to client.

What I'd like to know is -

  1. Is the above a standard approach for this type of usecase?
  2. Is there a better scheme than plain concatenation? I
  3. Guess RSA OAEP / PSS schemes are intended to guard against such attacks for RSA but I am more inclined towards the above since its independent of the algorithm (RSA/DSA). Am I correct in this assumption?
Improve this question
$\endgroup$
10
  • 1
    $\begingroup$ Your description has mixed up cipher suites (encryption schemes) and digital signatures in a confusing way.) . Rest, I hardly get what you are trying to achieve here. Better use tested and well scrutinized schemes like PSS (which is provably as secure as the RSA problem) $\endgroup$
    – Manish Adhikari
    Mar 3, 2021 at 8:24
  • 1
    $\begingroup$ OAEP is an encryption schemes which should be protected against people trying to decrypt or distinguish anything the legitimate system has not decrypted for you, using CPA/CCA type attacks. PSS is signature scheme designed to prevent others using chosen message attack from forging signatures on messages the system has not signed $\endgroup$
    – Manish Adhikari
    Mar 3, 2021 at 8:30
  • $\begingroup$ The idea is to reduce load on the cryptographic devices when the payload sizes are large (MB/GB's rather than in KB's). So one solution is to pre-calculate the hash on conventional systems and just ask the cryptographic-device to sign the hash provided as a direct input. However this scheme opens up possibility for chosen-plaintext attacks. So need to come up with a scheme to guard against it. $\endgroup$
    – Ravindra HV
    Mar 4, 2021 at 4:12
  • $\begingroup$ Your scheme does rely on collision resistant property of the hash function, lest an adversary forges signatures by creating collision. on large data. Another thing is while the server may be generally blind to the actual message: would it be problem in your application if the server detects a seen message from the hash though?, it may be a good thing because it allows server to deny any responsibility about actual message. $\endgroup$
    – Manish Adhikari
    Mar 4, 2021 at 4:36
  • 1
    $\begingroup$ And, you do not sign the hash. Hashing in whatever way it is done is part of the signature scheme and cannot be separated. For example in EdDSA, the way hashing is done, it does not rely on collision resistant property of hash function (even though I would not use MD5 or SHA1). But with your scheme, even if you use EdDSA, your hash function CANNOT be ANYTHING BUT COLLISION RESISTANT, in other words, it gives less security guarantee than the signature scheme (EdDSA) used. $\endgroup$
    – Manish Adhikari
    Mar 4, 2021 at 4:43

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.