Considering blacklist of PKCS 1.5 in SP 2.5

[Olav Morken]

On Fri, Jul 27, 2012 at 17:48:59 +0000, Cantor, Scott wrote:
> A couple of years ago, a paper was published demonstrating practical
> attacks on PKCS 1.5 that have some mitigations, which we implemented. Now
> another paper[1] has been published that manages to attack OAEP by using a
> downgrade attack that substitutes PKCS 1.5 in the message.

After having read that paper, it does not appear to talk about such an 
attack, but rather a different attack against PKCS 1.5. Did I miss 
something, or were you thinking of a different paper?

[...]
> There is one apparent exception: simpleSAML.php uses PKCS 1.5 with AES
> keys. It's apparently a simple change to make it use OAEP, but it's not
> doing that at the moment. Our feeling is that this latest attack
> demonstrates a need for them to make that change, and that we need to do
> the responsible thing and turn this off by default going forward.

I think the least we can do in simpleSAMLphp is to change the default 
to RSA-OAEP. It is long overdue in any case. Since all current 
installations use PKCS 1.5, I think we will also add protection against 
the attack in [1].

> [1] 
> http://www.nds.rub.de/research/publications/breaking-xml-encryption-pkcs15/


Best regards,
Olav Morken
UNINETT / Feide