Considering blacklist of PKCS 1.5 in SP 2.5

[Olav Morken]

On Tue, Jul 31, 2012 at 14:16:30 +0000, Cantor, Scott wrote:
> > For what it is worth, I now have a simple patch that (as far as I
> > understand it) should fix the attack in [1], which I plan to release
> > as a security update soon. The change to using RSA-OAEP will obviously
> > have to wait for the next stable series, since it changes the behaviour
> > of the software.
> 
> I don't see any way you could fix the code other than by blocking use of PKCS 1.5. Of course, the attack is against a decrypter, not the encrypter. You could in theory block decryption with PKCS 1.5 while still using it to encrypt.

The attack in the paper relies on a combination of two things:

(1) That the simple way to protect against a timing attack with the 
    Bleichenbacher's attack is to substitute a random symmetric key if 
    we fail to decrypt the symmetric key. Thus, by testing the same 
    encrypted key multiple times, you can get different results.

(2) That it is easy to create a ciphertext block that decrypts to 
    "valid XML" (e.g. an empty string). By tweaking the IV, you can be 
    certain to create at least one ciphertext that should decrypt to an 
    empty string in 256 attempts.

For (1), we can substitude a "random" but deterministic key, so that it 
will always yield the same (incorrect) symmetric key for a given 
encrypted key and private key.

For (2), we can increase the difficulty by also requiring that the 
decrypted data is an XML element. (We never decrypt anything that isn't 
a complete XML element.) Thus the attacker has to test a larger number 
of different inputs, rather than just 256 inputs.


Now I just hope that I haven't overlooked something :)

Best regards,
Olav Morken
UNINETT / Feide