Cryptography Stack Exchange
Cryptography Stack Exchange

Questions tagged [pkcs1]

PKCS#1 is the first standard published by RSA Security, which was setup by the inventors of RSA, Rivest, Shamir and Adleman. It describes how the RSA problem can be used to perform secure signature generation and encryption.

PKCS#1 is generally used when it comes to describing the padding mechanism of RSA. PKCS#1 however also describes the modular exponentiation and integer to octet string conversion (I2OSP and OS2IP). Furthermore, the PKCS#1 standard lists the possible hashing algorithms that can be used for signature generation. Finally it contains an ASN.1 specification for the various data structures used.

Currently version 2.1 and 2.2 of PKCS#1 are mostly referred to. Version 2.0 added the OAEP encryption algorithm and version 2.1 the PSS signature generation algorithm. It however also cover the PKCS#1 v1.5 padding scheme for backwards compatibility. Version 2.2 mainly completes the support of the various SHA-2 hash algorithms. Wikipedia has a list with the changes within the various versions.

The PKCS#1 v1.5 padding schemes for signature generation and encryption differ. This can introduce confusion, programming errors and vulnerabilities if the schemes are used without knowledge about the schemes or cryptographic API. The PKCS#1 v1.5 padding and signature scheme is deterministic while the PKCS#1 v1.5 padding scheme for encryption is non-deterministic (relies on a random number generator). The PKCS#1 v1.5 scheme for encryption can be vulnerable to padding oracle attacks.

OAEP and PSS have a security proof that states that OAEP and PSS are secure given that the underlying primitives (RSA and the hash algorithms) are secure.

PKCS#1 does not offer support for deterministic encryption or homomorphic encryption. Neither does it indicate how the key generation should be performed or how the modular exponentiation function can be implemented or secured.

52 questions
55
votes
2 answers

What security authorities and standards reject $e=3$ in RSA, when, and with what rationale?

 In RSA, some security authorities and/or standards allow the public exponent $e=3$, others require or recommend $e>2^{16}$ (or perhaps some other minimum). I gathered the following: PKCS#1 allows $e=3$ for both RSA digital signature and encryption…
fgrieu
  • 149,326
  • 13
  • 324
  • 622
17
votes
1 answer

Should I be using PKCS1 v1.5 or PSS for RSA signatures?

I am implementing an application where a user needs to sign some data that they have created, store it in an untrusted place, then later retrieve that data and verify it is still authentic before using it. The user already has a RSA keypair for…
izzle
  • 621
  • 1
  • 5
  • 12
10
votes
0 answers

Are there attacks against broken RSA signature pad checking with $e = 65537$?

Let's say that an RSA implementation of PKCS #1 signatures fails to validate that the 00 01 FF FF FF ... FF 00 portion of the decrypted signature is exactly as long as needed to fill up the signature block entirely when appended with the hash…
Myria
  • 2,635
  • 15
  • 26
10
votes
1 answer

Why did OAEP change from PKCS#1 v2.0 and v2.1?

In PKCS#1 v2.1 the OAEP output is prepending with a null byte. Quoting RFC 3447, i. Concatenate a single octet with hexadecimal value 0x00, maskedSeed, and maskedDB to form an encoded message EM of length k octets as EM = 0x00…
neubert
  • 2,969
  • 1
  • 29
  • 58
9
votes
1 answer

The 9 lives of Bleichenbacher's CAT, it puts another scratch again

Bleichenbacher demonstrated a padding oracle attack against RSA implementations that follow the PKCS #1 v1.5. Through the years, there are various mitigation techniques developed as OAEP and limiting the number of query execution over a period of…
kelalaka
  • 49,797
  • 12
  • 123
  • 211
7
votes
2 answers

Why does adding PKCS#1 v1.5 padding make RSA encryption non-deterministic?

I'm quite a beginner to cryptography, but have been implementing some encryption according to a specification over the last few weeks using the PyCrypto library. I've discovered that when encrypting using RSA public keys alone, encryption appears to…
majackson
  • 181
  • 1
  • 1
  • 4
7
votes
1 answer

Why is the seed masked in OAEP

In the OAEP padding/armoring scheme for RSA encryption, the seed used is masked (with the masked data block) in the end. Why is that necessary, since the seed is random anyway?
mat
  • 2,558
  • 1
  • 14
  • 28
6
votes
1 answer

What are the differences between plain and encrypted private keys?

It seems like there are different kind of private key formats, namely: PKCS#5 plain private key PKCS#8 plain private key PKCS#5 encrypted private key PKCS#8 encrypted private key I have seen these names of keys thrown around in articles and…
xenon
  • 235
  • 1
  • 2
  • 7
5
votes
1 answer

Security of RSA-3072 with public exponent $2^{16}+1$

NSA recommendation for the pre-quantum period allows the use of RSA-3072 (https://apps.nsa.gov/iaarchive/programs/iad-initiatives/cnsa-suite.cfm), nevertheless, is it safe enough to do it with the above exponent (of $2^{16}+1$), and are there any…
Evgeni Vaknin
  • 1,155
  • 8
  • 20
5
votes
2 answers

Why PS does differ between PKCS1 v1.5 padding for signature and for encryption?

As you may know, PKCS#1 defines two different padding in it's v1.5 : one for signature and one for encryption. Here they are : The middle part is refered as PS in the standard. There is only one thing bothering me : why does PS differ between…
Faulst
  • 852
  • 8
  • 19
5
votes
1 answer

Can MGF1 within OAEP and PSS be replaced by a XOF?

Do we still need MGF1 as used in the PKCS#1 v2.x specifications for SHA-3 hash functions? MGF1 is currently used for OAEP and PSS as Mask Generation Function. Now that the SHA-3 specification contains SHAKE128 and SHAKE256 could MGF1 be replaced? It…
Maarten Bodewes
  • 96,351
  • 14
  • 169
  • 323
4
votes
1 answer

Did the formalization of PKCS#1 RSA key formats come before or after X.509?

The paper introducing the RSA cryptosystem titled "A Method for Obtaining Digital Signature and Public-Key Cryptosystems" was published in 1978. The initial version of X.500 published by CCITT (predecessor of ITU-T) dates back to 1988, with the…
DannyNiu
  • 10,640
  • 2
  • 27
  • 64
4
votes
2 answers

OpenSSL - extract hash algorithm from signature data (PKCS#1 v 1.5)

PKCS#1 v 1.5 stores hash algorithm identifier that was used to digest the original message. I would like to know if and how to extract this information. I am working on a buffer containing the signature bytes and a buffer with public key. I know it…
Mroov
  • 43
  • 5
4
votes
1 answer

What is the difference between PKCS1 v1.5 and PKCS7? Is PKCS7 a superset of specifications in PKCS1 1.5?

I have a requirement wherein we have to verify the PE binaries generated for an aarch64 platform. These binaries are then signed using the opensource sbsign tool to generate a signed PE binary with PKCS7 signedData structure included in the SECURITY…
Faisal
  • 143
  • 1
  • 3
4
votes
1 answer

Is this Bleichenbacher '06 style signature forgery possible? (Or more like, why isn't it?)

I assume that most of you know this, but just for the sake of context; Bleichenbacher's signature forgery (https://www.ietf.org/mail-archive/web/openpgp/current/msg00999.html) basically abuses implementations that do not check that the PKCS#1 1.5…
Attila Szasz
  • 43
  • 3
1
2 3 4