32
votes
Accepted
Which attacks are possible against raw/textbook RSA?
This describes some attacks against textbook RSA (also known as raw RSA), where the public function $x\mapsto y=x^e\bmod N$ or private function $y\mapsto x=y^d\bmod N$ are applied directly to the ...
21
votes
Accepted
If RSA is only used to encrypt symmetric keys which are random, what's wrong with textbook RSA?
This is a common mistake, so I'd like to give an in-depth answer. Basically, what you are proposing is to rely on the ONE-WAYNESS of RSA as a ONE-WAY FUNCTION, rather than relying on its CPA or CCA ...
- 26.9k
20
votes
What security authorities and standards reject $e=3$ in RSA, when, and with what rationale?
Rather than making an overly long question even longer, I post this as an answer.
As part of the update process of the French security recommendations linked in the question, I suggested (June 2013) a ...
- 122k
16
votes
Accepted
How does PKCS 1.5 solve the insecureness of Textbook RSA?
PKCS#1 v1.5 describes a method (formally known as RSAES-PKCS1-v1_5) that turns textbook RSA into a (heuristically) secure encryption scheme for small messages (PKCS#...
- 122k
14
votes
How to encrypt the number one using RSA?
The algorithm you quote is usually called textbook RSA and is not used in practice for numerous security reasons (the problem you pointed out, is just one of them).
In practice, you have to pad (or ...
- 2,458
13
votes
Accepted
Why is it OK for secretbox to leak the message length?
It is usually assumed that the length of the message is not secret. Even with padding the approximate length is leaked, and necessarily any encryption reveals a maximum length – or at least ...
- 31.2k
13
votes
Accepted
GCM padding or not?
TL;DR: Padding is part of the specification of the mode and thus doesn't need to be done by the user of the primitive.
Internally GCM really is CTR mode along with a polynomial hashing function ...
- 44.6k
12
votes
Accepted
How much safer is RSA-OAEP compared to RSA with PKCS#1 v1.5 padding?
RSA PKCS#1 is still secure if padding oracles do not apply. If padding oracles apply, for instance when a server verifies the padding after decryption and somehow leaks the result (through an error ...
- 84.6k
12
votes
Accepted
The 9 lives of Bleichenbacher's CAT, it puts another scratch again
How does the new attack work at top level?
In short
They used BEAST-like Man in the Browser attack by using Cache-like attacks to perform a downgrade attack against any TLS connection to a ...
- 43k
12
votes
Random data CBC padding scheme?
Padding is dangerous. CBC mode with padding is secure against chosen-plaintext attacks, where the adversary can convince the legitimate party to encrypt messages and obtain the ciphertexts. But it is ...
11
votes
Accepted
What prevents a padding standard to cause a data loss?
Padding is always added, even if the plaintext is a product of the block size. This way the algorithm look for the last byte(s) and can safely interpret it as padding data. In case of alignment to the ...
- 226
10
votes
Which attacks are possible against raw/textbook RSA?
Textbook RSA encryption scheme is not IND-CPA secure as it is a deterministic scheme.
Textbook RSA signature scheme is not secure considering Existential Unforgability under Chosen Message Attack. e.g....
10
votes
How does PKCS 1.5 solve the insecureness of Textbook RSA?
The Structure of PKCS#1 v1.5 as follows;
The message $m$ is padded to
x = 0x00 || 0x02 || r || 0x00 || m
and the ciphertext calculated as $c=x^e\bmod N$ not ...
- 43k
9
votes
Accepted
Why not use OAEP for signatures?
One good reason not to use RSAES-OAEP for signature is because as it stands, it can't do signature! RSAES-OAEP performs encryption of a message (of limited length) with optional label into a ...
- 122k
8
votes
Which attacks are possible against raw/textbook NTRU encryption?
Without a well-designed padding system it may be possible to craft a ciphertext that the decryptor may or may not be able to decrypt properly. Whether the decryptor is able to do so will depend on the ...
- 131k
8
votes
Accepted
Why are hashes padded only at the end of the block?
Is it somehow connected with sequentially reading in files /data of unknown length?
Yes, indeed. It is part of a requirement to perform online message processing, or, in other words, the ability to ...
- 84.6k
8
votes
Accepted
Can we calculate AES-CBC-PKCS7 ciphertext length based on the length of the plaintext?
PKCS7 uses mandatory padding. Even if the length of your data is a multiple of your block size, it will pad.
...
- 224
8
votes
Accepted
AES-CBC Padding: Why always attach 16x 0x10 pad?
You are talking about the PKCS#7 padding. There is a simple reason; assume that when the last block is full and you don't apply the padding before encryption and then send the message.
When ...
- 43k
7
votes
How does compression before encryption leak info about the input?
The problem is not with compression and encryption, it is with the protocol that is being used, and the type of data being compressed (or not) prior to encryption.
The most damning leaks are on ...
- 12.6k
7
votes
Accepted
What are the relative merits of padding algorithms pkcs7, iso7816, and x923?
ANSI x.923 padding and the padding used within PKCS#7 are functionally equivalent. The last byte of the padding stream is the length of the padding stream. The difference is the value of the other ...
- 12.6k
7
votes
Which attacks are possible against raw/textbook NTRU encryption?
I am a cryptographic researcher at Security Innovation, which acquired NTRU.
Apart from the aforementioned attack, there are two significant attacks, namely a chosen plaintext attack (CPA) and a ...
- 661
7
votes
Accepted
Does EAX require padding to be secure?
The EAX mode of operation is defined for 128 bit block ciphers. It consists of a combination of CTR mode for confidentiality and OMAC for authentication and nonce derivation. CTR mode does not require ...
- 10.2k
7
votes
Accepted
Padding RSA with random number
The system proposed has no practical interest.
If $r$ is public, then it is easy to check a guess $\overline m$ of $m$ (compute $\overline m'=\overline m+r$, feed it to the RSA function, and compare ...
- 122k
7
votes
Accepted
Security of RSA for padding $\texttt{0x00|message|random_bytes}$
Your message format is;
$$\texttt{padded_message} =\texttt{|0x00|message|random_bytes|}$$
You did not specify what will happen if the message is short. If we assume that it is filled with zero then ...
- 43k
7
votes
Accepted
How can I hash an input into an arbitrary domain point?
Hash functions we use, e.g. Sha-1, Sha-256, Sha-512, usually don’t have a sufficiently large range. But we can construct full domain hash via repeated application of a hash function $h$: $FDH(m) = h(m|...
- 4,008
6
votes
What is the length field in SHA-512 padding?
In $\text{SHA-512}$ the size of the blocks is 1024 bit. The last block must contain:
the rest of data in message (mod 1024).
some filling (padding)
the last 128 bits as ...
6
votes
Attacking RSA signature verification that ignores padding
If you were using $e=3$, then there is a well known attack by Bleichenbacher that enables the trivial generation of a signature that passes verification. This attack was never published, but is ...
- 26.9k
6
votes
Accepted
Computing the padding of MD5
That's correct. Here are the padding instructions from RFC1321, the MD5 spec:
...
- 2,706
6
votes
How does AES/CTR/PKCS5Padding works when the bits to encrypt is more than 8 bits
PKCS#5 was initially written for block ciphers using 64-bit blocks, and up to and including PKCS#5v2.0 had no provision for larger ones. PKCS#5v2.1 remains littered with references to eight octets, ...
- 122k
6
votes
Accepted
Why does symmetric encryption require padding?
Symmetric crypto does not always have padding. Stream ciphers often will not require padding. Padding is necessary when using a cipher that requires plaintexts to be a multiple of a particular size. ...
- 37.7k
Only top scored, non community-wiki answers of a minimum length are eligible