Considering blacklist of PKCS 1.5 in SP 2.5

[Olav Morken]

On Mon, Jul 30, 2012 at 14:05:41 +0000, Cantor, Scott wrote:
> On 7/30/12 5:07 AM, "Olav Morken" <olav.morken at uninett.no> wrote:
> >
> >After having read that paper, it does not appear to talk about such an
> >attack, but rather a different attack against PKCS 1.5. Did I miss
> >something, or were you thinking of a different paper?
> 
> Yes, I think you missed the point of the paper. The attack is against an
> OAEP-padded key by telling a consumer it's actually PKCS 1.5. The attack
> is against OAEP, by leveraging a combination of attacks involving two
> broken algorithms. If you block PKCS 1.5, you aren't vulnerable to it (in
> this case even if you leave on CBC, which is not really something you can
> turn off in practice today).

The reason I am asking is that I cannot see any description of such an 
attack in the paper. It only mentiones OAEP three times in total. Is it 
a generic attack described elsewhere, which means that as soon as you 
find a weakness in PKCS 1.5, you can use it to attack OAEP? If so, do 
you have a link or title of the paper?

> >I think the least we can do in simpleSAMLphp is to change the default
> >to RSA-OAEP. It is long overdue in any case. Since all current
> >installations use PKCS 1.5, I think we will also add protection against
> >the attack in [1].
> 
> Thanks. That reinforces our position.
> 
> We (meaning me) will also be adding a new blacklist capability to the next
> release in a few days that inserts, by default, a set of blacklisted
> algorithms into the code by default. This will allow us to issue patches
> that disable algorithms without deployers needing to change config files,
> but leaves an option to re-enable them if desired.

For what it is worth, I now have a simple patch that (as far as I 
understand it) should fix the attack in [1], which I plan to release 
as a security update soon. The change to using RSA-OAEP will obviously 
have to wait for the next stable series, since it changes the behaviour 
of the software.

[1] http://www.nds.rub.de/research/publications/breaking-xml-encryption-pkcs15/

Best regards,
Olav Morken
UNINETT / Feide