Comment

Comment by tptacek

This is a fine article, but of course, you should never use RSA implemented like this. In fact, the PKCS1v15 implementation here is itself vulnerable to a textbook padding oracle attack (it errors out on busted padding). This is in set #6 of the cryptopals challenges and is a pretty fun way to learn some things about how RSA works.

A cool recent paper on automating not just this attack but all kinds of "format oracle" attacks --- padding, headers, &c --- using SMT solvers:

https://eprint.iacr.org/2019/958.pdf

parent tptacek 7 years ago

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton