Subject: Be careful with that axe, Eugene

From: Jon Callas <[email-masked]>
Date: Tue, 16 Mar 2004 09:11:56 -0800

I put in this note in -11 in security considerations about PKCS1 
padding:

      * PKCS1 has been found to be vulnerable to attacks in which a
        system reports that errors in padding differently from errors in
        decryption becomes a random oracle that can leak the private key
        in mere millions of queries. Implementations must be aware of
        this attack and prevent it from happening. The simplest solution
        is report a single error code for all variants of decryption
        errors so as not to leak information to an attacker.

I don't want to beat this to death, given that the consensus seems to 
be that this is both an error to worry about, but an implementation 
error that is presently something smart coders should know about.

If there are small changes someone wants, feel free to write them up. I 
read the uPnP section that Carl mentioned. I think we are terser, but 
no less informative. I think the above lets someone who has a real 
reason not to take the suggested workaround a clue that they might want 
to start googling.

	Jon

---

From: Bill Frantz <[email-masked]>
Date: Tue, 16 Mar 2004 12:34:17 -0800

>I put in this note in -11 in security considerations about PKCS1

It might be good to also warn about timing attacks.  Here is a possible
paragraph (one sentence added):

      * PKCS1 has been found to be vulnerable to attacks in which a
        system reports that errors in padding differently from errors in
        decryption becomes a random oracle that can leak the private key
        in mere millions of queries. Implementations must be aware of
        this attack and prevent it from happening. The simplest solution
        is report a single error code for all variants of decryption
        errors so as not to leak information to an attacker.  It may
        be necessary to make the timing of responses the same for all
        cases as well.

Cheers - Bill

-------------------------------------------------------------------------
Bill Frantz        | "There's nothing so clear as a | Periwinkle
(408)356-8506      | vague idea you haven't written | 16345 Englewood Ave
www.pwpconsult.com | down yet." -- Dean Tribble     | Los Gatos, CA 95032