Skip to main content
16 votes
Accepted

How does PKCS 1.5 solve the insecureness of Textbook RSA?

PKCS#1 v1.5 describes a method (formally known as RSAES-PKCS1-v1_5) that turns textbook RSA into a (heuristically) secure encryption scheme for small messages (PKCS#...
fgrieu's user avatar
  • 141k
15 votes
Accepted

GCM padding or not?

TL;DR: Padding is part of the specification of the mode and thus doesn't need to be done by the user of the primitive. Internally GCM really is CTR mode along with a polynomial hashing function ...
SEJPM's user avatar
  • 46k
14 votes
Accepted

How much safer is RSA-OAEP compared to RSA with PKCS#1 v1.5 padding?

RSA PKCS#1 is still secure if padding oracles do not apply. If padding oracles apply, for instance when a server verifies the padding after decryption and somehow leaks the result (through an error ...
Maarten Bodewes's user avatar
  • 92.7k
14 votes

How to encrypt the number one using RSA?

The algorithm you quote is usually called textbook RSA and is not used in practice for numerous security reasons (the problem you pointed out, is just one of them). In practice, you have to pad (or ...
mat's user avatar
  • 2,528
14 votes
Accepted

The 9 lives of Bleichenbacher's CAT, it puts another scratch again

How does the new attack work at top level? In short They used BEAST-like Man in the Browser attack by using Cache-like attacks to perform a downgrade attack against any TLS connection to a ...
kelalaka's user avatar
  • 48.5k
12 votes

Random data CBC padding scheme?

Padding is dangerous. CBC mode with padding is secure against chosen-plaintext attacks, where the adversary can convince the legitimate party to encrypt messages and obtain the ciphertexts. But it is ...
Gilles 'SO- stop being evil''s user avatar
10 votes

How does PKCS 1.5 solve the insecureness of Textbook RSA?

The Structure of PKCS#1 v1.5 as follows; The message $m$ is padded to x = 0x00 || 0x02 || r || 0x00 || m and the ciphertext calculated as $c=x^e\bmod N$ not ...
kelalaka's user avatar
  • 48.5k
9 votes
Accepted

Can we calculate AES-CBC-PKCS7 ciphertext length based on the length of the plaintext?

PKCS7 uses mandatory padding. Even if the length of your data is a multiple of your block size, it will pad. ...
krishna T's user avatar
  • 234
8 votes

Which attacks are possible against raw/textbook NTRU encryption?

I am a cryptographic researcher at Security Innovation, which acquired NTRU. Apart from the aforementioned attack, there are two significant attacks, namely a chosen plaintext attack (CPA) and a ...
zhenfei zhang's user avatar
8 votes

Which attacks are possible against raw/textbook NTRU encryption?

Without a well-designed padding system it may be possible to craft a ciphertext that the decryptor may or may not be able to decrypt properly. Whether the decryptor is able to do so will depend on the ...
poncho's user avatar
  • 147k
8 votes
Accepted

Why are hashes padded only at the end of the block?

Is it somehow connected with sequentially reading in files /data of unknown length? Yes, indeed. It is part of a requirement to perform online message processing, or, in other words, the ability to ...
Maarten Bodewes's user avatar
  • 92.7k
8 votes
Accepted

Why does adding PKCS#1 v1.5 padding make RSA encryption non-deterministic?

When you use textbook RSA, the public key is $(e,N)$ and the ciphertext of a message $m$ is $c = m^e\bmod N$. The encryption process of textbook RSA involves no randomness; this causes the problem. It ...
Changyu Dong's user avatar
  • 4,178
8 votes
Accepted

AES-CBC Padding: Why always attach 16x 0x10 pad?

You are talking about the PKCS#7 padding. There is a simple reason; assume that when the last block is full and you don't apply the padding before encryption and then send the message. When ...
kelalaka's user avatar
  • 48.5k
7 votes
Accepted

Does EAX require padding to be secure?

The EAX mode of operation is defined for 128 bit block ciphers. It consists of a combination of CTR mode for confidentiality and OMAC for authentication and nonce derivation. CTR mode does not require ...
Henrick Hellström's user avatar
7 votes
Accepted

Padding RSA with random number

The system proposed has no practical interest. If $r$ is public, then it is easy to check a guess $\overline m$ of $m$ (compute $\overline m'=\overline m+r$, feed it to the RSA function, and compare ...
fgrieu's user avatar
  • 141k
7 votes
Accepted

Security of RSA for padding $\texttt{0x00|message|random_bytes}$

Your message format is; $$\texttt{padded_message} =\texttt{|0x00|message|random_bytes|}$$ You did not specify what will happen if the message is short. If we assume that it is filled with zero then ...
kelalaka's user avatar
  • 48.5k
7 votes
Accepted

How can I hash an input into an arbitrary domain point?

Hash functions we use, e.g. Sha-1, Sha-256, Sha-512, usually don’t have a sufficiently large range. But we can construct full domain hash via repeated application of a hash function $h$: $FDH(m) = h(m|...
Changyu Dong's user avatar
  • 4,178
7 votes
Accepted

best padding scheme for RSA

PKCS#1 contains 4 padding schemes, of which only 2 are suitable for encryption, but only of small data blocks (like up to hundred bytes): the modern RSAES-OAEP, and the obsolete RSAES-PKCS1-v1_5 (...
fgrieu's user avatar
  • 141k
6 votes

What is the length field in SHA-512 padding?

In $\text{SHA-512}$ the size of the blocks is 1024 bit. The last block must contain: the rest of data in message (mod 1024). some filling (padding) the last 128 bits as ...
Ibrahim Albarki's user avatar
6 votes
Accepted

Can MGF1 within OAEP and PSS be replaced by a XOF?

It seems that the authors of Keccak sponge (the algorithm chosen to be SHA-3) do think their SHAKE functions can directly be used for simplifying OAEP and PSS: The introduction of extendable-output ...
Maarten Bodewes's user avatar
  • 92.7k
6 votes

How does AES/CTR/PKCS5Padding works when the bits to encrypt is more than 8 bits

PKCS#5 was initially written for block ciphers using 64-bit blocks, and up to and including PKCS#5v2.0 had no provision for larger ones. PKCS#5v2.1 remains littered with references to eight octets, ...
fgrieu's user avatar
  • 141k
6 votes
Accepted

Why does symmetric encryption require padding?

Symmetric crypto does not always have padding. Stream ciphers often will not require padding. Padding is necessary when using a cipher that requires plaintexts to be a multiple of a particular size. ...
mikeazo's user avatar
  • 38.6k
6 votes

Why does SHA-2 call for doing 10* padding in addition to appending the message length?

As rightly pointed in the question, 0*+length padding would work just as well as 10*+length padding, with the benefit of simplicity and requiring one less block in some cases, like SHA-256 for a ...
fgrieu's user avatar
  • 141k
6 votes

Can we calculate AES-CBC-PKCS7 ciphertext length based on the length of the plaintext?

AES is a block cipher with 128-bit block (regardless of its key size of 128, 192 or 256 bits); that is 16 octets. PKCS#7 padding adds from one octet to a full block. It thus transforms $n$ octets of ...
fgrieu's user avatar
  • 141k
6 votes
Accepted

Understanding how padding works when using Block Cipher

The padding scheme being used in your example for the block cipher is PKCS#7 Padding. This scheme specifies that: The value of each added byte is the number of bytes that are added, i.e. N bytes, ...
ka3de's user avatar
  • 160
6 votes

If OAEP is introducing randomness to encryption how could be ciphertext decrypted?

To decrypt the ciphertext you definitely need to recover the random token $r$. But $r = Y \oplus H(X)$. Then knowing $r$ the padded message can be recovered as $m0\dots0 = X \oplus G(r)$. The ...
ddddavidee's user avatar
  • 3,324
6 votes

What will be appropriate AES padding characters?

But is it the right way? There are various padding styles for this. The padding must be removed correctly and uniquely. For example, the all-zero padding may remove your actual information. If the ...
kelalaka's user avatar
  • 48.5k
6 votes
Accepted

PKCS#7 CMS - Message digest calculation process

Closely related: What does CMS standard mean by "initial input to the message digest" The signature schemes envisioned by PKCS7/CMS use two stages, where the data to be signed is first ...
dave_thompson_085's user avatar
6 votes

Actual RSA encryption & decryption of strings?

Practically, when RSA is used to encrypt strings, what is the $x$ in $x^e\bmod n$? That depends on the variant of RSA. Among the most common: Toy-sized textbook RSA, where the public modulus $n$ is ...
fgrieu's user avatar
  • 141k
6 votes

Why does Merkle-Damgård hashing involve putting the padding at the end instead of at the start?

I can only provide a programming sense to this; One may not know the size of the message beforehand (streaming), when finished, the length-padding can be executed nicely at the end. Otherwise, the ...
kelalaka's user avatar
  • 48.5k

Only top scored, non community-wiki answers of a minimum length are eligible