Questions tagged [pkcs1]

PKCS#1 is the first standard published by RSA Security, which was setup by the inventors of RSA, Rivest, Shamir and Adleman. It describes how the RSA problem can be used to perform secure signature generation and encryption.

Filter by
Sorted by
Tagged with
3 votes
1 answer
235 views

Implications of switching RSA padding schemes

In my company we want to switch from PKCSv1.5 to PSS for RSA signing. This is because of the marvin attack vector. My question is, if an adversary can see many similar messages that were signed with ...
whomaniac's user avatar
  • 133
4 votes
1 answer
93 views

Is Bypassing Padding Verification in RSA-PSS Dangerous?

I am currently working on a project involving RSA-PSS (Probabilistic Signature Scheme) for digital signatures. While researching potential vulnerabilities, I came across the well-known Bleichenbacher ...
user113612's user avatar
1 vote
1 answer
209 views

Differences between two RSA signatures using OpenSSL

I want to sign a file called data.txt and store its signature in data.txt.sig. To create the signature, I want to use an ...
Allgaeuer's user avatar
  • 123
0 votes
0 answers
96 views

JSON Web Encryption (JWE) Key Wrapping Fundamentals - How To Encrypt Content Encryption Key?

The JSON Web Encryption RFC 7516 says: Encrypt the CEK with the recipient's public key using the RSAES-PKCS1-v1_5 [or RSAES-OAEP] algorithm to produce the JWE Encrypted Key. Assuming a client/server ...
Ronnie Royston's user avatar
0 votes
0 answers
169 views

How to get dp and dq of CRT-RSA?

I am learning to utilize flush+reload method to get private key of CRT-RSA. CRT-RSA calculates two parts separately: mp = c^dp mod p and ...
Gerrie's user avatar
  • 101
0 votes
2 answers
866 views

PKCS#7 SignedData - how is the "encryptedDigest" constructed for RSAES‐PKCS‐v1_5?

I need to use Azure Key Vault HSM to sign arbitrary data in a PKCS#7 CMS. There are plenty of libraries and packages that can do this if you supply them with the private key, but obviously I don't ...
user15045901's user avatar
3 votes
1 answer
299 views

Bleichenbacher '06 signature forgery against modified PKCS1 v1.5 format

Bleichenbacher’s ’06 RSA signature forgery targets incorrect PKCS1 v1.5 implementations where padding checks are omitted and RSA keys with e = 3 are used. As per ...
0xdead10cc's user avatar
0 votes
0 answers
106 views

Encrypt user AES keys with AWS KMS RSA key

I am developing a web application in which each user has some part of his data that is stored encrypted. We are hosted on AWS and I want to use KMS as part of the solution. To not make the solution ...
Adhocrat's user avatar
1 vote
1 answer
178 views

conflicting definitions for dP / dQ and exponent1 / exponent2 in PKCS 1?

In Section 2 dP and dQ are defined thusly: ...
neubert's user avatar
  • 2,927
1 vote
0 answers
631 views

PKCS#7 digest encryption algorithm - difference between rsaEncryption and sha256WithRsaEncryption

As part of our linux secure boot implementation using dm-verity and root hash signature checking, I need to sign a file with the following openssl command (example): ...
Werner Breitwieser's user avatar
1 vote
1 answer
78 views

What are the security implications of RSA decryption of ciphertext >= modulus?

While reading through the sections about decryption in PKCS#1 v2.2, I noticed that the decryption algorithms are required to output the failure symbol: ...
DannyNiu's user avatar
  • 9,207
3 votes
2 answers
619 views

How are the instantiations of RSAES-OAEP and SHA*WithRSAEncryption different in practice?

For the spare-time project I had been working on, I'm evaluating the PKCS#1 padded RSA schemes for implementation. For PKCS#1 v1.5, encryption doesn't seem to require a hash function, and the ...
DannyNiu's user avatar
  • 9,207
1 vote
0 answers
26 views

Does EESS#1 NTRUEncrypt use the PKCS#1 MGF (mask generation function)?

I downloaded the 1st-round NTRUEncrypt submission from NIST website, the spec mentions the mask generation function MGF1 in ASN.1 definition but not in algorithm description. Does the EESS#1 ...
DannyNiu's user avatar
  • 9,207
1 vote
0 answers
53 views

Interval for PKCS#1 v1.5 compliant plaintext

In Bleichenbacher's paper (http://archiv.infsec.ethz.ch/education/fs08/secsem/bleichenbacher98.pdf, section 3.1) he concludes that if m*s is PKCS#1 v1.5 compliant we get the following interval: $2B \...
user16910689's user avatar
5 votes
1 answer
721 views

Security of RSA-3072 with public exponent $2^{16}+1$

NSA recommendation for the pre-quantum period allows the use of RSA-3072 (https://apps.nsa.gov/iaarchive/programs/iad-initiatives/cnsa-suite.cfm), nevertheless, is it safe enough to do it with the ...
Evgeni Vaknin's user avatar
2 votes
1 answer
232 views

Where does the range of possible values in Bleichenbacher's attack against PKCS #1 come from?

In Bleichenbacher's paper on his attack against PKCS #1, we find: If the oracle says that $c'$ is PKCS conforming, then the attacker knows that the first two bytes of $ms$ are $\mathtt{00}$ and $\...
user87241's user avatar
1 vote
1 answer
154 views

Generating a SHA256 pkcs1v1.5 Blind RSA Signature using Chaum's Blind Signature Scheme

I am a noob to cryptography in the sense that I have only little understanding as to how RSA encryption schemes work in practice. However I do understand the theoretical foundations of RSA ...
Ev3ryDay1sL3gDay's user avatar
4 votes
1 answer
108 views

Did the formalization of PKCS#1 RSA key formats come before or after X.509?

The paper introducing the RSA cryptosystem titled "A Method for Obtaining Digital Signature and Public-Key Cryptosystems" was published in 1978. The initial version of X.500 published by ...
DannyNiu's user avatar
  • 9,207
1 vote
1 answer
277 views

PKCS RSA - Why do we need encoding [duplicate]

In the RSASSA-PKCS-v1_5 signature scheme, the first step is to perform an encoding on the hashed data. (0x00||0x01||PS||0x00||T). Is this encoding important for security ? What happens if the hash is ...
cmdEvo's user avatar
  • 57
2 votes
1 answer
850 views

PKCS#1: Purpose of `Padding1` in EMSA-PSS encoding method

The central part of the RSASSA-PSS signature scheme of PKCS#1 is the EMSA-PSS encoding operation, described in section 9.1 of ...
Morrolan's user avatar
  • 1,147
4 votes
2 answers
2k views

OpenSSL - extract hash algorithm from signature data (PKCS#1 v 1.5)

PKCS#1 v 1.5 stores hash algorithm identifier that was used to digest the original message. I would like to know if and how to extract this information. I am working on a buffer containing the ...
Mroov's user avatar
  • 43
0 votes
0 answers
581 views

Relation between signature size and message-digest length in RSA PKCS#1v1.5 sign/verify

When using RSA-PKCS#1v1.5 to sign and verify a message-digest, is there a compulsory relation between the sizes of message-digest and the key/signature ? For example, If I use key/signature length of ...
alonco's user avatar
  • 75
3 votes
2 answers
269 views

Bleichenbacher attack test vectors

I was trying to understand the Bleichenbacher attack. I went through the paper of Bleichenbacher to understand it a bit more. However, I tried to get some test vectors to simulate this attack locally ...
Vikash's user avatar
  • 68
2 votes
1 answer
2k views

RSA signing - does EMSA-PKCS1-v1_5 padding need to be verified?

I am working with an embedded system that accepts firmware updates only if they are validly signed by a particular 2048-bit RSA private key (the embedded system's bootloader knows the corresponding ...
John Lindgren's user avatar
3 votes
1 answer
3k views

Which padding is used for sha256WithRSAEncryption (1.2.840.113549.1.1.11), deterministic or random?

Questions Is the only way to know which padding was used is to know the context of how sha256WithRSAEncryption was used (that PS is 0xFF when signing, and random non-zero when encrypting)? Is there ...
Jason Pyeron's user avatar
4 votes
1 answer
3k views

What is the difference between PKCS1 v1.5 and PKCS7? Is PKCS7 a superset of specifications in PKCS1 1.5?

I have a requirement wherein we have to verify the PE binaries generated for an aarch64 platform. These binaries are then signed using the opensource sbsign tool ...
Faisal's user avatar
  • 143
2 votes
1 answer
96 views

consequences of using fixed values with OAEP

With DSA / ECDSA using a fixed $k$ means the private key can be trivially easily calculated from two different signatures. To remedy this RFC6979 Deterministic Usage of the Digital Signature Algorithm ...
neubert's user avatar
  • 2,927
3 votes
0 answers
3k views

OAEP Security: PKCS#1 v1.5 vs SHA1 vs SHA256

I'm looking at two major RSA encryption standards: PKCS#1 ver. 1.5 RSA OAEP The second one can use different hashing functions to create a hash of encoding parameters and then verify the hash at ...
Oleg Gryb's user avatar
  • 366
7 votes
2 answers
18k views

Why does adding PKCS#1 v1.5 padding make RSA encryption non-deterministic?

I'm quite a beginner to cryptography, but have been implementing some encryption according to a specification over the last few weeks using the PyCrypto library. I've discovered that when encrypting ...
majackson's user avatar
  • 181
9 votes
1 answer
3k views

The 9 lives of Bleichenbacher's CAT, it puts another scratch again

Bleichenbacher demonstrated a padding oracle attack against RSA implementations that follow the PKCS #1 v1.5. Through the years, there are various mitigation techniques developed as OAEP and limiting ...
kelalaka's user avatar
  • 48.5k
1 vote
1 answer
768 views

How much data can I encrypt with RSA before I need to change the key

How much data can be encrypted with the same RSA key before it has to be changed? I looking for the total amount of data that can be encrypted for a single key pair, not the maximum length of data ...
Mat's user avatar
  • 11
5 votes
2 answers
4k views

Why PS does differ between PKCS1 v1.5 padding for signature and for encryption?

As you may know, PKCS#1 defines two different padding in it's v1.5 : one for signature and one for encryption. Here they are : The middle part is refered as PS in the standard. There is only one ...
Faulst's user avatar
  • 852
0 votes
1 answer
399 views

Why is the payload size is restricted when using RSA

Doing some research about cryptography, I've read many times that, when using RSA 1024 and PKCS#1, the size of the payload cannot be bigger than 117 bytes. This payload cannot be bigger than the ...
Marta Lobo's user avatar
4 votes
1 answer
1k views

Is this Bleichenbacher '06 style signature forgery possible? (Or more like, why isn't it?)

I assume that most of you know this, but just for the sake of context; Bleichenbacher's signature forgery (https://www.ietf.org/mail-archive/web/openpgp/current/msg00999.html) basically abuses ...
Attila Szasz's user avatar
2 votes
1 answer
277 views

Why do public keys for RSASSA-PKCS1-v1_5 follow a normal distribution?

I converted ~1000 public keys generated from chrome's RSASSA-PKCS1-v1_5 implementation, converted them to decimal, prepended a "0." to them, and sorted them. This is the graph that I got: It ...
guest's user avatar
  • 123
2 votes
1 answer
1k views

Security of RSA signature using PKCS 1.5

I'm using mbedTLS to generate RSA signatures, and using PKCS 1.5 I get consistent signature output. I wanted to ask/confirm here that this is secure? There's surely got to be a reason for the PSS ...
Dave P's user avatar
  • 23
1 vote
1 answer
210 views

Using RSA signature as a secret material

Can an RSA signature of a randomly generated seed be used as a secret material (for further protection of some data)? That sounds like some sort of KDF - but here built on top of the RSA signature ...
Max's user avatar
  • 85
3 votes
1 answer
173 views

Does the exact distribution of padding bytes in PKCSv1.5 type 1 matter?

[Disclaimer: I am fully aware PKCSv1.5 is horrible and should die (though tell that to the TLS v1.2 specification). I am asking this question for my own edification.] PKCSv1.5 encryption padding (as ...
Jack Lloyd's user avatar
  • 1,694
15 votes
1 answer
25k views

Should I be using PKCS1 v1.5 or PSS for RSA signatures?

I am implementing an application where a user needs to sign some data that they have created, store it in an untrusted place, then later retrieve that data and verify it is still authentic before ...
izzle's user avatar
  • 591
5 votes
1 answer
9k views

What are the differences between plain and encrypted private keys?

It seems like there are different kind of private key formats, namely: PKCS#5 plain private key PKCS#8 plain private key PKCS#5 encrypted private key PKCS#8 encrypted private key I have seen these ...
xenon's user avatar
  • 225
7 votes
1 answer
849 views

Why is the seed masked in OAEP

In the OAEP padding/armoring scheme for RSA encryption, the seed used is masked (with the masked data block) in the end. Why is that necessary, since the seed is random anyway?
mat's user avatar
  • 2,518
2 votes
1 answer
677 views

Zero byte header in RSA-OAEP vs. RSA-PSS

PKCS#1 v2.1/RFC3437 defines the OAEP padding mode for encryption and the PSS for signature padding. Both schemes are based on the generic constructions not specifically tailored to RSA by Rogaway &...
mat's user avatar
  • 2,518
1 vote
1 answer
142 views

TLS-conformant ciphertexts and SSLv2-conformant ciphertexts for Blechenbacher attack for DROWN attack

This is regarding the published paper on the DROWN attack (https://drownattack.com/drown-attack-original-report.pdf) It was mentioned in the paper that for TLS, RSA PKCS#1 v1.5 is used to encapsulate ...
meta_warrior's user avatar
2 votes
1 answer
939 views

What does the mask generation function in PKCS#1 output if the generated mask is shorter than the specified mask length?

I am implementing RSA-OAEP with the mask generation function as specified in PKCS #1. It says after producing the variable T to "output the leading maskLen octets of T as the octet string mask". ...
user avatar
10 votes
0 answers
813 views

Are there attacks against broken RSA signature pad checking with $e = 65537$?

Let's say that an RSA implementation of PKCS #1 signatures fails to validate that the 00 01 FF FF FF ... FF 00 portion of the decrypted signature is exactly as long ...
Myria's user avatar
  • 2,575
3 votes
1 answer
794 views

PKCS1 signing not recommended?

Daniel Roesler's personal page has a live examples table for WebCrypto support. https://diafygi.github.io/webcrypto-examples/ Without explination he marks several as "Discouraged! Only use for ...
dave.zap's user avatar
  • 493
0 votes
1 answer
337 views

Generation of random data for EME-OAEP

I'm using my own code to communicate with another party that's specified PKCS#1 V2.1 EME-OAEP encoding, with SHA-1 as the hash function. There are two places where random data is used in encoding a ...
M.M's user avatar
  • 223
1 vote
0 answers
140 views

Padding for blinded messages?

I have a message $m$ that I wish to send as a blinded message for approval (a signature) to then unbind and use as authority. Should I preform the procedure like so: pad $m$ using EMSA-PSS (...
driver4567's user avatar
10 votes
1 answer
2k views

Why did OAEP change from PKCS#1 v2.0 and v2.1?

In PKCS#1 v2.1 the OAEP output is prepending with a null byte. Quoting RFC 3447, ...
neubert's user avatar
  • 2,927
1 vote
1 answer
3k views

NIST test vectors for RSASSA-PKCS1-V1_5-SIGN with the SHA-256 hash function?

I haven't been able to find it on the web anywhere, and I need to check if my implementation of the algorithm is correct. Does NIST provide such a file?
user avatar