Is it possible to leak private key data if attacker control signing request ?
Everyone know N and E because they are public.
My server is designed to decrypt incoming request which is encrypted with public key.
make sign and for decrypted data which have SHA2 return back rsa sign for that data.
Is it possible that an attacker can learn my private key ?
I am testing this in my local workshop for education purposes.
i am using pkcs1 public key encrypted message for incoming request. data is decrypted by my private key and its have sha2 so i just make sign & return back signed data to client.
example in python
message = struct.pack('>IIII', 0, 0, 0, 1)
(pub, priv) = rsa.newkeys(512) //only for example i know no one use 512bit.
incoming request. encrypted = pkcs1.encrypt(message, pub)
server handle it. decrypted = pkcs1.decrypt(encrypted, priv)
signature = pkcs1.sign(decrypted, priv, 'SHA-256')
return back answer.