Hot answers tagged

5

Since the input sizes are fixed, length-extension attacks are not relevant, so any of the SHA-2 functions reasonably implements the random oracle model assumed by OAEP or PSS via MGF1—even the default of SHA-1 works with MGF1. Obviously it will cost slightly more to use SHA-224 or SHA-384 than to use SHA-256 or SHA-512 because SHA-224 and SHA-384 are ...


3

Yes, this is expected, if the RSASSA-PSS signing code/test uses salt the width of the hash, which is customary. In that case, a $h$-bit hash (with $h$ multiple of 8) requires an RSA public modulus at least $2h+9$ bits. That's semi-clearly stated in PKCS#1 v2.2, section 9.1.1, condition on enBits, with actual test in step 3. That's because the message ...


3

Q1: The random selection should be $\sqrt[3]{n}<m<n$ due to cube-root attack? Suppose $n$ is 2048 bits long. Then $\sqrt[3] n < 2^{700}$. If $m$ is uniformly distributed in $\{1, 2, \dots, n - 1, n\}$, what is $\Pr[m < \sqrt[3] n]$? Is this probability large enough that you have to worry about it? Now at the end the document it says; ...


2

node-jose only supports RSA OAEP with SHA-1 and no MGF1 or RSA OAEP with SHA-256 and no MGF1 That's extremely unlikely since OAEP does need to use a Mask Generation Function, and there is only one defined: MGF1. So maybe it doesn't specify it explicitly, but it really must support it to be called OAEP. But I'm wondering about RSA OAEP SHA-1. Nimbus JOSE ...


2

If you encrypt something with low entropy but use a fixed seed for OAEP, it is trivial to brute force it, and verify your guesses with public key, while randomized all or nothing padding will make verifying a guess impossible. In the context of signatures rather than encryption, it doesn't seem as severe, but you are supplying the attacker with a bunch of ...


2

If you use the same padding on the same messages, sent to multiple different public keys, then you have satisfied the criteria of the Håstad attack. Randomizing the padding as in OAEP means that you don't use the same padding for each message. Even better, in a modern system like RSA-KEM, there's no ‘padding’ per se, or even any ‘message’ involved directly ...


Only top voted, non community-wiki answers of a minimum length are eligible