Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

# Tag Info

### What security authorities and standards reject $e=3$ in RSA, when, and with what rationale?

Rather than making an overly long question even longer, I post this as an answer. As part of the update process of the French security recommendations linked in the question, I suggested (June 2013) a ...
• 122k
Accepted

### Should I be using PKCS1 v1.5 or PSS for RSA signatures?

Which of these should I be using? PKCS1 v1.5 seems a bit simpler to implement. Generally you should not be implementing this yourself, there are plenty of libraries that implement these schemes out ...
• 84.7k
Accepted

### The 9 lives of Bleichenbacher's CAT, it puts another scratch again

How does the new attack work at top level? In short They used BEAST-like Man in the Browser attack by using Cache-like attacks to perform a downgrade attack against any TLS connection to a ...
• 43.1k

### Security of RSA-3072 with public exponent $2^{16}+1$

is it safe enough to do it with the above exponent (of 2^16+1), and are there any known vulnerabilities for scheme EMSA-PSS (RFC8017) or for scheme RSAES-PKCS1-v1_5 done with this signature system? ...
• 131k
Accepted

When you use textbook RSA, the public key is $(e,N)$ and the ciphertext of a message $m$ is $c = m^e\bmod N$. The encryption process of textbook RSA involves no randomness; this causes the problem. ...
• 4,008
Accepted

### What are the differences between plain and encrypted private keys?

There is no such thing as a PKCS#5 plain private key. PKCS#5 defines Password Based Encryption (PBE) and it is noted that this can be used to encrypt a private key. PKCS#8 does define plain and ...
• 84.7k
Accepted

### Can MGF1 within OAEP and PSS be replaced by a XOF?

It seems that the authors of Keccak sponge (the algorithm chosen to be SHA-3) do think their SHAKE functions can directly be used for simplifying OAEP and PSS: The introduction of extendable-output ...
• 84.7k
Accepted

### why did oaep change from pkcs1 v2.0 and v2.1?

The answer is relatively simple, but I'll expand on the details of the changes from PKCS#1 2.0 to 2.1 in two additional sections below this answer. On the padding with the zero valued byte The I2OSP ...
• 84.7k
Accepted

### Which padding is used for sha256WithRSAEncryption (1.2.840.113549.1.1.11), deterministic or random?

It uses deterministic padding, i.e. padding with FF octets, finalized by a single 00 valued byte. So it is indeed RSASSA-PKCS1-...
• 84.7k
Accepted

### PKCS1 signing not recommended?

Well, you are as surprised as I believe most of us are... AES-CTR and AES-CBC are "obsolete", whilst AES-CTR is used by AES-GCM. Okay, so maybe he recommends authenticated modes (which don't require ...
• 2,910

### Why PS does differ between PKCS1 v1.5 padding for signature and for encryption?

Maarten Bodewes answer is correct, but it is missing one important point. It is actually NOT secure to have randomness in PKCS#1V1.5 padded signatures, otherwise signatures could be forged via ...
• 141
Accepted

### Why PS does differ between PKCS1 v1.5 padding for signature and for encryption?

The 01 and 02 valued bytes before the PS are used for domain separation; each scheme has it's own unique value that way. For a ...
• 84.7k
Accepted

### Why is the payload size is restricted when using RSA

When you're talking about RSA-1024, the "1024" refers to the bit length of n, so n is 128 bytes long. Now let's take a look at RSA decryption process : In order to recover your plaintext, you will ...
• 822
Accepted

• 84.7k
Accepted

### PKCS RSA - Why do we need encoding

As per section 9 of the paper, the encoding used is required for the security of the scheme. The encoding operation may introduce some randomness, so that different applications of the encoding ...
• 1,423