Hot answers tagged

32 votes
Accepted

Which attacks are possible against raw/textbook RSA?

This describes some attacks against textbook RSA (also known as raw RSA), where the public function $x\mapsto y=x^e\bmod N$ or private function $y\mapsto x=y^d\bmod N$ are applied directly to the ...
21 votes
Accepted

If RSA is only used to encrypt symmetric keys which are random, what's wrong with textbook RSA?

This is a common mistake, so I'd like to give an in-depth answer. Basically, what you are proposing is to rely on the ONE-WAYNESS of RSA as a ONE-WAY FUNCTION, rather than relying on its CPA or CCA ...
user avatar
20 votes

What security authorities and standards reject $e=3$ in RSA, when, and with what rationale?

Rather than making an overly long question even longer, I post this as an answer. As part of the update process of the French security recommendations linked in the question, I suggested (June 2013) a ...
user avatar
  • 122k
16 votes
Accepted

How does PKCS 1.5 solve the insecureness of Textbook RSA?

PKCS#1 v1.5 describes a method (formally known as RSAES-PKCS1-v1_5) that turns textbook RSA into a (heuristically) secure encryption scheme for small messages (PKCS#...
user avatar
  • 122k
14 votes

How to encrypt the number one using RSA?

The algorithm you quote is usually called textbook RSA and is not used in practice for numerous security reasons (the problem you pointed out, is just one of them). In practice, you have to pad (or ...
user avatar
  • 2,458
13 votes
Accepted

Why is it OK for secretbox to leak the message length?

It is usually assumed that the length of the message is not secret. Even with padding the approximate length is leaked, and necessarily any encryption reveals a maximum length – or at least ...
user avatar
  • 31.2k
13 votes
Accepted

GCM padding or not?

TL;DR: Padding is part of the specification of the mode and thus doesn't need to be done by the user of the primitive. Internally GCM really is CTR mode along with a polynomial hashing function ...
user avatar
  • 44.6k
12 votes
Accepted

How much safer is RSA-OAEP compared to RSA with PKCS#1 v1.5 padding?

RSA PKCS#1 is still secure if padding oracles do not apply. If padding oracles apply, for instance when a server verifies the padding after decryption and somehow leaks the result (through an error ...
user avatar
  • 84.6k
12 votes
Accepted

The 9 lives of Bleichenbacher's CAT, it puts another scratch again

How does the new attack work at top level? In short They used BEAST-like Man in the Browser attack by using Cache-like attacks to perform a downgrade attack against any TLS connection to a ...
user avatar
  • 43k
12 votes

Random data CBC padding scheme?

Padding is dangerous. CBC mode with padding is secure against chosen-plaintext attacks, where the adversary can convince the legitimate party to encrypt messages and obtain the ciphertexts. But it is ...
user avatar
11 votes
Accepted

What prevents a padding standard to cause a data loss?

Padding is always added, even if the plaintext is a product of the block size. This way the algorithm look for the last byte(s) and can safely interpret it as padding data. In case of alignment to the ...
user avatar
10 votes

Which attacks are possible against raw/textbook RSA?

Textbook RSA encryption scheme is not IND-CPA secure as it is a deterministic scheme. Textbook RSA signature scheme is not secure considering Existential Unforgability under Chosen Message Attack. e.g....
10 votes

How does PKCS 1.5 solve the insecureness of Textbook RSA?

The Structure of PKCS#1 v1.5 as follows; The message $m$ is padded to x = 0x00 || 0x02 || r || 0x00 || m and the ciphertext calculated as $c=x^e\bmod N$ not ...
user avatar
  • 43k
9 votes
Accepted

Why not use OAEP for signatures?

One good reason not to use RSAES-OAEP for signature is because as it stands, it can't do signature! RSAES-OAEP performs encryption of a message (of limited length) with optional label into a ...
user avatar
  • 122k
8 votes

Which attacks are possible against raw/textbook NTRU encryption?

Without a well-designed padding system it may be possible to craft a ciphertext that the decryptor may or may not be able to decrypt properly. Whether the decryptor is able to do so will depend on the ...
user avatar
  • 131k
8 votes
Accepted

Why are hashes padded only at the end of the block?

Is it somehow connected with sequentially reading in files /data of unknown length? Yes, indeed. It is part of a requirement to perform online message processing, or, in other words, the ability to ...
user avatar
  • 84.6k
8 votes
Accepted

Can we calculate AES-CBC-PKCS7 ciphertext length based on the length of the plaintext?

PKCS7 uses mandatory padding. Even if the length of your data is a multiple of your block size, it will pad. ...
user avatar
8 votes
Accepted

AES-CBC Padding: Why always attach 16x 0x10 pad?

You are talking about the PKCS#7 padding. There is a simple reason; assume that when the last block is full and you don't apply the padding before encryption and then send the message. When ...
user avatar
  • 43k
7 votes

How does compression before encryption leak info about the input?

The problem is not with compression and encryption, it is with the protocol that is being used, and the type of data being compressed (or not) prior to encryption. The most damning leaks are on ...
user avatar
  • 12.6k
7 votes
Accepted

What are the relative merits of padding algorithms pkcs7, iso7816, and x923?

ANSI x.923 padding and the padding used within PKCS#7 are functionally equivalent. The last byte of the padding stream is the length of the padding stream. The difference is the value of the other ...
user avatar
  • 12.6k
7 votes

Which attacks are possible against raw/textbook NTRU encryption?

I am a cryptographic researcher at Security Innovation, which acquired NTRU. Apart from the aforementioned attack, there are two significant attacks, namely a chosen plaintext attack (CPA) and a ...
user avatar
7 votes
Accepted

Does EAX require padding to be secure?

The EAX mode of operation is defined for 128 bit block ciphers. It consists of a combination of CTR mode for confidentiality and OMAC for authentication and nonce derivation. CTR mode does not require ...
user avatar
7 votes
Accepted

Padding RSA with random number

The system proposed has no practical interest. If $r$ is public, then it is easy to check a guess $\overline m$ of $m$ (compute $\overline m'=\overline m+r$, feed it to the RSA function, and compare ...
user avatar
  • 122k
7 votes
Accepted

Security of RSA for padding $\texttt{0x00|message|random_bytes}$

Your message format is; $$\texttt{padded_message} =\texttt{|0x00|message|random_bytes|}$$ You did not specify what will happen if the message is short. If we assume that it is filled with zero then ...
user avatar
  • 43k
7 votes
Accepted

How can I hash an input into an arbitrary domain point?

Hash functions we use, e.g. Sha-1, Sha-256, Sha-512, usually don’t have a sufficiently large range. But we can construct full domain hash via repeated application of a hash function $h$: $FDH(m) = h(m|...
user avatar
  • 4,008
6 votes

What is the length field in SHA-512 padding?

In $\text{SHA-512}$ the size of the blocks is 1024 bit. The last block must contain: the rest of data in message (mod 1024). some filling (padding) the last 128 bits as ...
user avatar
6 votes

Attacking RSA signature verification that ignores padding

If you were using $e=3$, then there is a well known attack by Bleichenbacher that enables the trivial generation of a signature that passes verification. This attack was never published, but is ...
user avatar
6 votes
Accepted

Computing the padding of MD5

That's correct. Here are the padding instructions from RFC1321, the MD5 spec: ...
user avatar
  • 2,706
6 votes

How does AES/CTR/PKCS5Padding works when the bits to encrypt is more than 8 bits

PKCS#5 was initially written for block ciphers using 64-bit blocks, and up to and including PKCS#5v2.0 had no provision for larger ones. PKCS#5v2.1 remains littered with references to eight octets, ...
user avatar
  • 122k
6 votes
Accepted

Why does symmetric encryption require padding?

Symmetric crypto does not always have padding. Stream ciphers often will not require padding. Padding is necessary when using a cipher that requires plaintexts to be a multiple of a particular size. ...
user avatar
  • 37.7k

Only top scored, non community-wiki answers of a minimum length are eligible