Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs
14 votes
Accepted

Should I be using PKCS1 v1.5 or PSS for RSA signatures?

Which of these should I be using? PKCS1 v1.5 seems a bit simpler to implement. Generally you should not be implementing this yourself, there are plenty of libraries that implement these schemes out ...
Maarten Bodewes's user avatar
  • 92.9k
14 votes
Accepted

The 9 lives of Bleichenbacher's CAT, it puts another scratch again

How does the new attack work at top level? In short They used BEAST-like Man in the Browser attack by using Cache-like attacks to perform a downgrade attack against any TLS connection to a ...
kelalaka's user avatar
  • 48.7k
8 votes
Accepted

Why does adding PKCS#1 v1.5 padding make RSA encryption non-deterministic?

When you use textbook RSA, the public key is $(e,N)$ and the ciphertext of a message $m$ is $c = m^e\bmod N$. The encryption process of textbook RSA involves no randomness; this causes the problem. It ...
Changyu Dong's user avatar
  • 4,178
8 votes

Security of RSA-3072 with public exponent $2^{16}+1$

is it safe enough to do it with the above exponent (of 2^16+1), and are there any known vulnerabilities for scheme EMSA-PSS (RFC8017) or for scheme RSAES-PKCS1-v1_5 done with this signature system? ...
poncho's user avatar
  • 148k
6 votes
Accepted

Can MGF1 within OAEP and PSS be replaced by a XOF?

It seems that the authors of Keccak sponge (the algorithm chosen to be SHA-3) do think their SHAKE functions can directly be used for simplifying OAEP and PSS: The introduction of extendable-output ...
Maarten Bodewes's user avatar
  • 92.9k
6 votes
Accepted

What are the differences between plain and encrypted private keys?

There is no such thing as a PKCS#5 plain private key. PKCS#5 defines Password Based Encryption (PBE) and it is noted that this can be used to encrypt a private key. PKCS#8 does define plain and ...
Maarten Bodewes's user avatar
  • 92.9k
6 votes
Accepted

Why did OAEP change from PKCS#1 v2.0 and v2.1?

The answer is relatively simple, but I'll expand on the details of the changes from PKCS#1 2.0 to 2.1 in two additional sections below this answer. On the padding with the zero valued byte The I2OSP ...
Maarten Bodewes's user avatar
  • 92.9k
4 votes
Accepted

PKCS1 signing not recommended?

Well, you are as surprised as I believe most of us are... AES-CTR and AES-CBC are "obsolete", whilst AES-CTR is used by AES-GCM. Okay, so maybe he recommends authenticated modes (which don't require ...
axapaxa's user avatar
  • 2,950
4 votes

Why PS does differ between PKCS1 v1.5 padding for signature and for encryption?

Maarten Bodewes answer is correct, but it is missing one important point. It is actually NOT secure to have randomness in PKCS#1V1.5 padded signatures, otherwise signatures could be forged via ...
swolfe's user avatar
  • 141
4 votes
Accepted

Why PS does differ between PKCS1 v1.5 padding for signature and for encryption?

The 01 and 02 valued bytes before the PS are used for domain separation; each scheme has it's own unique value that way. For a ...
Maarten Bodewes's user avatar
  • 92.9k
4 votes
Accepted

Why is the payload size is restricted when using RSA

When you're talking about RSA-1024, the "1024" refers to the bit length of n, so n is 128 bytes long. Now let's take a look at RSA decryption process : In order to recover your plaintext, you will ...
Faulst's user avatar
  • 852
4 votes

Why does adding PKCS#1 v1.5 padding make RSA encryption non-deterministic?

It is nice that you have tested if from the first hands. The textbook RSA encryption is deterministic in the sense that given a public key $(e,n)$ and two plaintext $0 \leq m_1,m_2 < n$ if $$ c_1=\...
kelalaka's user avatar
  • 48.7k
4 votes
Accepted

Which padding is used for sha256WithRSAEncryption (1.2.840.113549.1.1.11), deterministic or random?

It uses deterministic padding, i.e. padding with FF octets, finalized by a single 00 valued byte. So it is indeed RSASSA-PKCS1-...
Maarten Bodewes's user avatar
  • 92.9k
4 votes
Accepted

OpenSSL - extract hash algorithm from signature data (PKCS#1 v 1.5)

The hash identifier of a given RSASSA-PKCS1-v1_5 signature can only be obtained using the signature's public key¹. It's revealed by performing the signature verification steps 1 and 2/a/b/c (which ...
fgrieu's user avatar
  • 142k
4 votes
Accepted

conflicting definitions for dP / dQ and exponent1 / exponent2 in PKCS 1?

The formulas are equivalent. From §3.2: $e \cdot d \equiv 1 \pmod{\lambda(n)}$, i.e. $e \cdot d - 1 \equiv 0 \pmod{\lambda(n)}$, i.e. $\lambda(n)$ divides $e \cdot d - 1$. From §3.1: $\lambda(n) = \...
Gilles 'SO- stop being evil''s user avatar
4 votes
Accepted

Implications of switching RSA padding schemes

Read the next section for why it's likely not necessary to make any change. But let's answer the question anyway. If an adversary can see many similar messages that were signed with both (RSASSA-...
fgrieu's user avatar
  • 142k
3 votes
Accepted

PKCS#1: Purpose of `Padding1` in EMSA-PSS encoding method

I conjecture that this salt is essentially a version number for future extensions, tasked with ensuring that signature per another version using a different salt is not a valid signature for the ...
fgrieu's user avatar
  • 142k
3 votes

Bleichenbacher attack test vectors

As mentioned by j.p., the original attack has been (quite significantly) improved in 2012 and some great tutorials are available online, often demonstrated with example. If you want a more exhaustive ...
Faulst's user avatar
  • 852
3 votes
Accepted

RSA signing - does EMSA-PKCS1-v1_5 padding need to be verified?

Is step #3 (verifying the EMSA-PKCS1-v1_5 padding) important to the security of the system? Yes. That's paramount for small RSA public exponent $e$. Lacking this check, for $e\in\{3,5,7\}$, the ...
fgrieu's user avatar
  • 142k
3 votes

How much data can I encrypt with RSA before I need to change the key

The reason that you won't find much is that RSA is generally not used for bulk encryption, instead hybrid encryption is used. For RSA using PKCS #1 v1.5 padding you generally don't want to go above $...
Maarten Bodewes's user avatar
  • 92.9k
3 votes
Accepted

Is this Bleichenbacher '06 style signature forgery possible? (Or more like, why isn't it?)

Now, I'm wondering about the case where an implementation does check that the hash is right-justified, but doesn't check the previous bytes at all. That case is completely broken for $e=3$ ...
poncho's user avatar
  • 148k
3 votes
Accepted

Security of RSA signature using PKCS 1.5

Provided you follow PKCS#1 v1.5 verification exactly, and don't attempt shortcuts like checking only the hash part of the message hash representative, it should be fine. There's no security reduction ...
Squeamish Ossifrage's user avatar
3 votes

NIST test vectors for RSASSA-PKCS1-V1_5-SIGN with the SHA-256 hash function?

A zip file of test vectors (FIPS 186-2 Algoithm Test Vectors for RSA) can be found at the bottom of the page on NIST's site pertaining to CAVP Testing: Digital Signatures. This file contains a ...
Xander's user avatar
  • 387
3 votes
Accepted

Differences between two RSA signatures using OpenSSL

There are several ways to build a signature scheme on top of RSA. The two main schemes are PKCS#1v1.5 (named after the version of the document called PKCS#1 that codified it) and PSS (also codified in ...
Gilles 'SO- stop being evil''s user avatar
2 votes

Why is the seed masked in OAEP

The point is that you will only be able to reconstruct the seed if you know every single bit of maskedSeed and maskedDB and you will be able to decode the message only if you know every single bit of ...
dhe25519's user avatar
2 votes
Accepted

Using RSA signature as a secret material

Yes, the idea of using RSA signature as KDF can work. The KDF's key will be the RSA private key, and the other input of the KDF will be the message to sign. Other requirements: Either: The signature ...
fgrieu's user avatar
  • 142k
2 votes
Accepted

What is the difference between PKCS1 v1.5 and PKCS7? Is PKCS7 a superset of specifications in PKCS1 1.5?

What is the difference between PKCS#1 v1.5 and PKCS#7? PKCS#7 makes use of cryptographic primitives defined by PKCS#1 v1.5. PKCS#7 is defined in RFC 2315. The modern PKCS#1 is v2.2 (also RFC 8017), ...
fgrieu's user avatar
  • 142k
2 votes
Accepted

consequences of using fixed values with OAEP

If you encrypt something with low entropy but use a fixed seed for OAEP, it is trivial to brute force it, and verify your guesses with public key, while randomized all or nothing padding will make ...
Meir Maor's user avatar
  • 11.8k
2 votes

Bleichenbacher attack test vectors

Here is another possibility for learning purposes. You could use the free, open-source elearning program CrypTool 2. In the tab "Crypto Tutorials" there is a section "Attacks on PKCS#1". There you can ...
phdgroupA's user avatar
2 votes
Accepted

PKCS RSA - Why do we need encoding

As per section 9 of the paper, the encoding used is required for the security of the scheme. The encoding operation may introduce some randomness, so that different applications of the encoding ...
Modal Nest's user avatar
  • 1,443

Only top scored, non community-wiki answers of a minimum length are eligible