Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [pkcs1]

PKCS#1 is the first standard published by RSA Security, which was setup by the inventors of RSA, Rivest, Shamir and Adleman. It describes how the RSA problem can be used to perform secure signature generation and encryption.

1
vote
1answer
56 views

How much data can I encrypt with RSA before I need to change the key

How much data can be encrypted with the same RSA key before it has to be changed? I looking for the total amount of data that can be encrypted for a single key pair, not the maximum length of data ...
2
votes
2answers
180 views

Why PS does differ between PKCS1 v1.5 padding for signature and for encryption?

As you may know, PKCS#1 defines two different padding in it's v1.5 : one for signature and one for encryption. Here they are : The middle part is refered as PS in the standard. There is only one ...
0
votes
1answer
61 views

Why is the payload size is restricted when using RSA

Doing some research about cryptography, I've read many times that, when using RSA 1024 and PKCS#1, the size of the payload cannot be bigger than 117 bytes. This payload cannot be bigger than the ...
3
votes
1answer
195 views

Is this Bleichenbacher '06 style signature forgery possible? (Or more like, why isn't it?)

I assume that most of you know this, but just for the sake of context; Bleichenbacher's signature forgery (https://www.ietf.org/mail-archive/web/openpgp/current/msg00999.html) basically abuses ...
1
vote
1answer
96 views

Why do public keys for RSASSA-PKCS1-v1_5 follow a normal distribution?

I converted ~1000 public keys generated from chrome's RSASSA-PKCS1-v1_5 implementation, converted them to decimal, prepended a "0." to them, and sorted them. This is the graph that I got: It ...
1
vote
1answer
359 views

Security of RSA signature using PKCS 1.5

I'm using mbedTLS to generate RSA signatures, and using PKCS 1.5 I get consistent signature output. I wanted to ask/confirm here that this is secure? There's surely got to be a reason for the PSS ...
1
vote
1answer
79 views

Using RSA signature as a secret material

Can an RSA signature of a randomly generated seed be used as a secret material (for further protection of some data)? That sounds like some sort of KDF - but here built on top of the RSA signature ...
3
votes
1answer
50 views

Does the exact distribution of padding bytes in PKCSv1.5 type 1 matter?

[Disclaimer: I am fully aware PKCSv1.5 is horrible and should die (though tell that to the TLS v1.2 specification). I am asking this question for my own edification.] PKCSv1.5 encryption padding (as ...
5
votes
1answer
5k views

Should I be using PKCS1 v1.5 or PSS for RSA signatures?

I am implementing an application where a user needs to sign some data that they have created, store it in an untrusted place, then later retrieve that data and verify it is still authentic before ...
0
votes
1answer
559 views

What are the differences between plain and encrypted private keys?

It seems like there are different kind of private key formats, namely: PKCS#5 plain private key PKCS#8 plain private key PKCS#5 encrypted private key PKCS#8 encrypted private key I have seen these ...
7
votes
1answer
243 views

Why is the seed masked in OAEP

In the OAEP padding/armoring scheme for RSA encryption, the seed used is masked (with the masked data block) in the end. Why is that necessary, since the seed is random anyway?
1
vote
1answer
348 views

Zero byte header in RSA-OAEP vs. RSA-PSS

PKCS#1 v2.1/RFC3437 defines the OAEP padding mode for encryption and the PSS for signature padding. Both schemes are based on the generic constructions not specifically tailored to RSA by Rogaway &...
1
vote
1answer
68 views

TLS-conformant ciphertexts and SSLv2-conformant ciphertexts for Blechenbacher attack for DROWN attack

This is regarding the published paper on the DROWN attack (https://drownattack.com/drown-attack-original-report.pdf) It was mentioned in the paper that for TLS, RSA PKCS#1 v1.5 is used to encapsulate ...
3
votes
1answer
321 views

What does the mask generation function in PKCS#1 output if the generated mask is shorter than the specified mask length?

I am implementing RSA-OAEP with the mask generation function as specified in PKCS #1. It says after producing the variable T to "output the leading maskLen octets of T as the octet string mask". ...
10
votes
0answers
540 views

Are there attacks against broken RSA signature pad checking with $e = 65537$?

Let's say that an RSA implementation of PKCS #1 signatures fails to validate that the 00 01 FF FF FF ... FF 00 portion of the decrypted signature is exactly as long ...
4
votes
1answer
317 views

PKCS1 signing not recommended?

Daniel Roesler's personal page has a live examples table for WebCrypto support. https://diafygi.github.io/webcrypto-examples/ Without explination he marks several as "Discouraged! Only use for ...
0
votes
1answer
130 views

Generation of random data for EME-OAEP

I'm using my own code to communicate with another party that's specified PKCS#1 V2.1 EME-OAEP encoding, with SHA-1 as the hash function. There are two places where random data is used in encoding a ...
1
vote
0answers
99 views

Padding for blinded messages?

I have a message $m$ that I wish to send as a blinded message for approval (a signature) to then unbind and use as authority. Should I preform the procedure like so: pad $m$ using EMSA-PSS (...
8
votes
1answer
416 views

why did oaep change from pkcs1 v2.0 and v2.1?

In PKCS1 v2.1 the OAEP output is prepending with a null byte. Quoting RFC3447, ...
1
vote
1answer
1k views

NIST test vectors for RSASSA-PKCS1-V1_5-SIGN with the SHA-256 hash function?

I haven't been able to find it on the web anywhere, and I need to check if my implementation of the algorithm is correct. Does NIST provide such a file?
3
votes
1answer
402 views

Can MGF1 within OAEP and PSS be replaced by a XOF?

Do we still need MGF1 as used in the PKCS#1 v2.x specifications for SHA-3 hash functions? MGF1 is currently used for OAEP and PSS as Mask Generation Function. Now that the SHA-3 specification contains ...