Considering blacklist of PKCS 1.5 in SP 2.5

[Cantor, Scott]

On 7/30/12 5:07 AM, "Olav Morken" <olav.morken at uninett.no> wrote:
>
>After having read that paper, it does not appear to talk about such an
>attack, but rather a different attack against PKCS 1.5. Did I miss
>something, or were you thinking of a different paper?

Yes, I think you missed the point of the paper. The attack is against an
OAEP-padded key by telling a consumer it's actually PKCS 1.5. The attack
is against OAEP, by leveraging a combination of attacks involving two
broken algorithms. If you block PKCS 1.5, you aren't vulnerable to it (in
this case even if you leave on CBC, which is not really something you can
turn off in practice today).

>I think the least we can do in simpleSAMLphp is to change the default
>to RSA-OAEP. It is long overdue in any case. Since all current
>installations use PKCS 1.5, I think we will also add protection against
>the attack in [1].

Thanks. That reinforces our position.

We (meaning me) will also be adding a new blacklist capability to the next
release in a few days that inserts, by default, a set of blacklisted
algorithms into the code by default. This will allow us to issue patches
that disable algorithms without deployers needing to change config files,
but leaves an option to re-enable them if desired.

-- Scott