Comments on: Why RSA encryption padding is critical

By: A Lurker

A Lurker — Mon, 15 Feb 2010 08:46:01 +0000

an attacker would have to be extremely unlucky to see a message not co-prime to the 6 non-trivial factors of A*B*C

I would call that lucky.

By: Nate Lawson

Nate Lawson — Fri, 23 Oct 2009 03:40:50 +0000

Yes, you see the problem. This kind of mistake reveals information about the ciphertext because there is no randomized padding. This is somewhat like reusing an IV with CBC encryption -- you can see patterns in the ciphertext just like ECB. Also, see Coppersmith's attack on low exponent RSA for how to recover plaintext when messages have differing padding that is predictable.

By: Huh

Huh — Wed, 21 Oct 2009 04:43:08 +0000

How can it be fatal to encrypt the same message (without padding) multiple times to the same recipient? Same message, same key, no padding == identical ciphertext, right?

By: Dave

Dave — Sat, 10 Oct 2009 06:55:57 +0000

Unfortunately in some cases the libraries need to support raw RSA for broken standards that require it. From memory the German HBCI (Home Banking Computer Interface), among other weirdness, uses unpadded RSA for example, so any crypto library that doesn’t support this can’t be used to implement the HBCI spec (amusing, you have to carefully check for DES weak keys before you use your unpadded RSA encryption on them :-). Having said that, saying that no *sane* implementation should be doing this is certainly valid.

By: kme

kme — Thu, 08 Oct 2009 03:05:57 +0000

A good followup to this would be a list of the functions from the common crypto libraries that do bare RSA encryption or signing operations without applying padding (ie those that expect the caller to pad). “If you’re calling one of these functions in your code, and you don’t know what RSA padding is, go get some expert help right now.”.

By: Nate Lawson

Nate Lawson — Wed, 07 Oct 2009 15:07:48 +0000

Joe, you are correct. I’ve edited the post for both your points. I couldn’t think of a good name for the “nth root problem”. I used your term “eth” since I didn’t want to confuse the RSA parameters n and e.

Also, I am using the term “field” a bit loosely in this post. Given that an attacker would have to be extremely unlucky to see a message not co-prime to the 6 non-trivial factors of A*B*C, they can treat it essentially as an integer root problem.