Considering blacklist of PKCS 1.5 in SP 2.5

[Cantor, Scott]

> The reason I am asking is that I cannot see any description of such an
> attack in the paper.

I'm not sure what you want me to say, but you need to look at it again, I guess.

> It only mentiones OAEP three times in total. Is it
> a generic attack described elsewhere, which means that as soon as you
> find a weakness in PKCS 1.5, you can use it to attack OAEP? If so, do
> you have a link or title of the paper?

That is the paper.

The attack is that they discovered a way to create a timing oracle against an OAEP wrapped key by downgrading the message to PKCS 1.5 and using chosen ciphertext in CBC mode. It's a combination of existing attacks plus a downgrade attack. The only fix I can see is to block either CBC or PKCS 1.5, and the latter is a lot more practical than the former.

> For what it is worth, I now have a simple patch that (as far as I
> understand it) should fix the attack in [1], which I plan to release
> as a security update soon. The change to using RSA-OAEP will obviously
> have to wait for the next stable series, since it changes the behaviour
> of the software.

I don't see any way you could fix the code other than by blocking use of PKCS 1.5. Of course, the attack is against a decrypter, not the encrypter. You could in theory block decryption with PKCS 1.5 while still using it to encrypt.

-- Scott