We’re rewarding the question askers & reputations are being recalculated! Read more.

# Tag Info

7

Uses for SHAKE/XOF functions Community wiki answer, please add and edit: key derivation of any type such as turning a 128-256 bit secret key into an ECC or RSA public/private key pair deterministic secure uniform random number generation starting from a small seed this might be used in fuzzing tools, simulations, etc. where you want a lot of random data ...

6

To decrypt the ciphertext you definitely need to recover the random token $r$. But $r = Y \oplus H(X)$. Then knowing $r$ the padded message can be recovered as $m0\dots0 = X \oplus G(r)$. The decryptor only need to known the size of the random token $r$ and this is usually part of the standard. Of course the standard has to define the $F$ and $G$ functions ...

5

Since the input sizes are fixed, length-extension attacks are not relevant, so any of the SHA-2 functions reasonably implements the random oracle model assumed by OAEP or PSS via MGF1—even the default of SHA-1 works with MGF1. Obviously it will cost slightly more to use SHA-224 or SHA-384 than to use SHA-256 or SHA-512 because SHA-224 and SHA-384 are ...

5

You are right that in decryption we need to know the value of $r$, but this can be easily recovered from the ciphertext alone, in fact, $r = Y \oplus H(X)$ and both $X,Y,H$ are known. Then the message can be recovered as $m00..0 = X \oplus G(r)$ Now, you might wonder how to depad from zeros, or equivalenty how can the decryptor distinguish between $X$ and $... 5 For any reasonable RSA-based encryption (or signature) scheme, exponent$e = 3$is a perfectly good choice and provides the best performance for the public-key operation short of qualitatively different Rabin-type schemes. Don't use RSAES-PKCS1-v1_5. RSAES-OAEP of PKCS#1 v2 is reasonable in this sense, though it is unnecessarily complicated. RSA-KEM is even ... 4 If you know the hash functions, yes. If the hash functions are secret, no—but how would you come into a situation where OAEP is being used with a secret hash function? For any hash functions$G$and$H$, OAEP is a fixed permutation involving no secret keys. Specifically, given a message$m$and randomization$r$, OAEP returns$(a, b)where \begin{align} ... 4 Direct use of textbook RSA for encryption is very insecure. For example, a guess of the plaintext can be checked: if what's encrypted is a name on the class roll, enciphering all names on the class roll until getting the ciphertext breaks confidentiality. There are several other attacks. That motivates RSA-OAEP. It turns textbook RSA, a hash, and a source ... 3 Beware that ifn < m$, then$\operatorname{SHAKE256-}\!n(x)$is a prefix of$\operatorname{SHAKE256-}\!m(x)$, so the two functions are not really independent random oracles as the usual OAEP theorems posit. If you set$G(x) = \operatorname{SHAKE256}(0 \mathbin\| x)$and$H(s) = \operatorname{SHAKE256}(1 \mathbin\| s)$, that should be adequate to (... 3 when encrypting a session key which is used to encrypt bulk data using a block cipher for example, is padding with OAEP really needed ? No if the session key is nearly as wide as the RSA modulus, or is padded with random bits up to that size (save for one bit or few high order bits). Absent other issues, we are safe if the actual session key keeps bits from ... 3 Q1: The random selection should be$\sqrt[3]{n}<m<n$due to cube-root attack? Suppose$n$is 2048 bits long. Then$\sqrt[3] n < 2^{700}$. If$m$is uniformly distributed in$\{1, 2, \dots, n - 1, n\}$, what is$\Pr[m < \sqrt[3] n]\$? Is this probability large enough that you have to worry about it? Now at the end the document it says; ...

2

If you encrypt something with low entropy but use a fixed seed for OAEP, it is trivial to brute force it, and verify your guesses with public key, while randomized all or nothing padding will make verifying a guess impossible. In the context of signatures rather than encryption, it doesn't seem as severe, but you are supplying the attacker with a bunch of ...

2

If you use the same padding on the same messages, sent to multiple different public keys, then you have satisfied the criteria of the Håstad attack. Randomizing the padding as in OAEP means that you don't use the same padding for each message. Even better, in a modern system like RSA-KEM, there's no ‘padding’ per se, or even any ‘message’ involved directly ...

Only top voted, non community-wiki answers of a minimum length are eligible