Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Hot answers tagged

20 votes

What security authorities and standards reject $e=3$ in RSA, when, and with what rationale?

Rather than making an overly long question even longer, I post this as an answer. As part of the update process of the French security recommendations linked in the question, I suggested (June 2013) a ...
user avatar
  • 122k
13 votes
Accepted

Should I be using PKCS1 v1.5 or PSS for RSA signatures?

Which of these should I be using? PKCS1 v1.5 seems a bit simpler to implement. Generally you should not be implementing this yourself, there are plenty of libraries that implement these schemes out ...
user avatar
  • 84.7k
12 votes
Accepted

The 9 lives of Bleichenbacher's CAT, it puts another scratch again

How does the new attack work at top level? In short They used BEAST-like Man in the Browser attack by using Cache-like attacks to perform a downgrade attack against any TLS connection to a ...
user avatar
  • 43.1k
8 votes

Security of RSA-3072 with public exponent $2^{16}+1$

is it safe enough to do it with the above exponent (of 2^16+1), and are there any known vulnerabilities for scheme EMSA-PSS (RFC8017) or for scheme RSAES-PKCS1-v1_5 done with this signature system? ...
user avatar
  • 131k
6 votes
Accepted

Why does adding PKCS#1 v1.5 padding make RSA encryption non-deterministic?

When you use textbook RSA, the public key is $(e,N)$ and the ciphertext of a message $m$ is $c = m^e\bmod N$. The encryption process of textbook RSA involves no randomness; this causes the problem. ...
user avatar
  • 4,008
6 votes
Accepted

What are the differences between plain and encrypted private keys?

There is no such thing as a PKCS#5 plain private key. PKCS#5 defines Password Based Encryption (PBE) and it is noted that this can be used to encrypt a private key. PKCS#8 does define plain and ...
user avatar
  • 84.7k
5 votes
Accepted

Can MGF1 within OAEP and PSS be replaced by a XOF?

It seems that the authors of Keccak sponge (the algorithm chosen to be SHA-3) do think their SHAKE functions can directly be used for simplifying OAEP and PSS: The introduction of extendable-output ...
user avatar
  • 84.7k
5 votes
Accepted

why did oaep change from pkcs1 v2.0 and v2.1?

The answer is relatively simple, but I'll expand on the details of the changes from PKCS#1 2.0 to 2.1 in two additional sections below this answer. On the padding with the zero valued byte The I2OSP ...
user avatar
  • 84.7k
4 votes
Accepted

Which padding is used for sha256WithRSAEncryption (1.2.840.113549.1.1.11), deterministic or random?

It uses deterministic padding, i.e. padding with FF octets, finalized by a single 00 valued byte. So it is indeed RSASSA-PKCS1-...
user avatar
  • 84.7k
4 votes
Accepted

PKCS1 signing not recommended?

Well, you are as surprised as I believe most of us are... AES-CTR and AES-CBC are "obsolete", whilst AES-CTR is used by AES-GCM. Okay, so maybe he recommends authenticated modes (which don't require ...
user avatar
  • 2,910
4 votes

Why PS does differ between PKCS1 v1.5 padding for signature and for encryption?

Maarten Bodewes answer is correct, but it is missing one important point. It is actually NOT secure to have randomness in PKCS#1V1.5 padded signatures, otherwise signatures could be forged via ...
user avatar
  • 141
4 votes
Accepted

Why PS does differ between PKCS1 v1.5 padding for signature and for encryption?

The 01 and 02 valued bytes before the PS are used for domain separation; each scheme has it's own unique value that way. For a ...
user avatar
  • 84.7k
4 votes
Accepted

Why is the payload size is restricted when using RSA

When you're talking about RSA-1024, the "1024" refers to the bit length of n, so n is 128 bytes long. Now let's take a look at RSA decryption process : In order to recover your plaintext, you will ...
user avatar
  • 822
4 votes
Accepted

conflicting definitions for dP / dQ and exponent1 / exponent2 in PKCS 1?

The formulas are equivalent. From §3.2: $e \cdot d \equiv 1 \pmod{\lambda(n)}$, i.e. $e \cdot d - 1 \equiv 0 \pmod{\lambda(n)}$, i.e. $\lambda(n)$ divides $e \cdot d - 1$. From §3.1: $\lambda(n) = \...
user avatar
3 votes
Accepted

Is this Bleichenbacher '06 style signature forgery possible? (Or more like, why isn't it?)

Now, I'm wondering about the case where an implementation does check that the hash is right-justified, but doesn't check the previous bytes at all. That case is completely broken for $e=3$ ...
user avatar
  • 131k
3 votes
Accepted

Security of RSA signature using PKCS 1.5

Provided you follow PKCS#1 v1.5 verification exactly, and don't attempt shortcuts like checking only the hash part of the message hash representative, it should be fine. There's no security reduction ...
user avatar
3 votes

NIST test vectors for RSASSA-PKCS1-V1_5-SIGN with the SHA-256 hash function?

A zip file of test vectors (FIPS 186-2 Algoithm Test Vectors for RSA) can be found at the bottom of the page on NIST's site pertaining to CAVP Testing: Digital Signatures. This file contains a ...
user avatar
  • 387
3 votes

Why does adding PKCS#1 v1.5 padding make RSA encryption non-deterministic?

It is nice that you have tested if from the first hands. The textbook RSA encryption is deterministic in the sense that given a public key $(e,n)$ and two plaintext $0 \leq m_1,m_2 < n$ if $$ c_1=\...
user avatar
  • 43.1k
3 votes

Bleichenbacher attack test vectors

As mentioned by j.p., the original attack has been (quite significantly) improved in 2012 and some great tutorials are available online, often demonstrated with example. If you want a more exhaustive ...
user avatar
  • 822
3 votes
Accepted

RSA signing - does EMSA-PKCS1-v1_5 padding need to be verified?

Is step #3 (verifying the EMSA-PKCS1-v1_5 padding) important to the security of the system? Yes. That's paramount for small RSA public exponent $e$. Lacking this check, for $e\in\{3,5,7\}$, the ...
user avatar
  • 122k
3 votes
Accepted

PKCS#1: Purpose of `Padding1` in EMSA-PSS encoding method

I conjecture that this salt is essentially a version number for future extensions, tasked with ensuring that signature per another version using a different salt is not a valid signature for the ...
user avatar
  • 122k
3 votes
Accepted

OpenSSL - extract hash algorithm from signature data (PKCS#1 v 1.5)

The hash identifier of a given RSASSA-PKCS1-v1_5 signature can only be obtained using the signature's public key¹. It's revealed by performing the signature verification steps 1 and 2/a/b/c (which ...
user avatar
  • 122k
2 votes

Bleichenbacher attack test vectors

Here is another possibility for learning purposes. You could use the free, open-source elearning program CrypTool 2. In the tab "Crypto Tutorials" there is a section "Attacks on PKCS#1". There you can ...
user avatar
2 votes
Accepted

What is the difference between PKCS1 v1.5 and PKCS7? Is PKCS7 a superset of specifications in PKCS1 1.5?

What is the difference between PKCS#1 v1.5 and PKCS#7? PKCS#7 makes use of cryptographic primitives defined by PKCS#1 v1.5. PKCS#7 is defined in RFC 2315. The modern PKCS#1 is v2.2 (also RFC 8017), ...
user avatar
  • 122k
2 votes
Accepted

consequences of using fixed values with OAEP

If you encrypt something with low entropy but use a fixed seed for OAEP, it is trivial to brute force it, and verify your guesses with public key, while randomized all or nothing padding will make ...
user avatar
  • 10.4k
2 votes

Why is the seed masked in OAEP

The point is that you will only be able to reconstruct the seed if you know every single bit of maskedSeed and maskedDB and you will be able to decode the message only if you know every single bit of ...
user avatar
2 votes
Accepted

Using RSA signature as a secret material

Yes, the idea of using RSA signature as KDF can work. The KDF's key will be the RSA private key, and the other input of the KDF will be the message to sign. Other requirements: Either: The signature ...
user avatar
  • 122k
2 votes

How much data can I encrypt with RSA before I need to change the key

The reason that you won't find much is that RSA is generally not used for bulk encryption, instead hybrid encryption is used. For RSA using PKCS #1 v1.5 padding you generally don't want to go above $...
user avatar
  • 84.7k
2 votes
Accepted

PKCS RSA - Why do we need encoding

As per section 9 of the paper, the encoding used is required for the security of the scheme. The encoding operation may introduce some randomness, so that different applications of the encoding ...
user avatar
  • 1,423
2 votes
Accepted

Did the formalization of PKCS#1 RSA key formats come before or after X.509?

Obviously formal RSA specs come after X.500 framework, but is it because of that reason, PKCS #1 choose to specify its key formats in terms of ASN.1? Yes, initial versions of PKCS #1 obviously had ...
user avatar
  • 6,551

Only top scored, non community-wiki answers of a minimum length are eligible