Repository navigation
Conversation
d1de0c3 to
163ee69
Compare
|
To reiterate my comment from #626: Instead of adding new APIs, features, etc, I would like to see implicit rejection added by removing the existing fallible handling of padding. If there are APIs that only handle padding errors the Ideally it should be a change that's largely invisible, but we should copiously document that PKCS#1 v1.5 padding errors no longer return an error but instead the pseudorandom rejection symbol. |
b69ef83 to
ab6455e
Compare
Removed the feature flag and made it the default behavior without introducing new APIs. |
017ee05 to
34351ea
Compare
34351ea to
4fa957e
Compare
|
Closing in favor of #749, which incorporates some of the code from this PR, thanks! |
Avoid a padding oracle by returning a deterministic rejection symbol rather than an error on padding failures. See sections 7.1/7.2 of: https://www.ietf.org/archive/id/draft-irtf-cfrg-rsa-guidance-10.html Incorporates some of the code from #680 / #702, where some of the code from the latter was merged in #739 (blinding support). Uses `cargo checkct` / BINSEC to verify constant-time operation. Closes #626
Avoid a padding oracle by returning a deterministic rejection symbol rather than an error on padding failures. See sections 7.1/7.2 of: https://www.ietf.org/archive/id/draft-irtf-cfrg-rsa-guidance-10.html Incorporates some of the code from #680 / #702, where some of the code from the latter was merged in #739 (blinding support). Uses `cargo checkct` / BINSEC to verify constant-time operation. Closes #626
Avoid a padding oracle by returning a deterministic rejection symbol rather than an error on padding failures. See sections 7.1/7.2 of: https://www.ietf.org/archive/id/draft-irtf-cfrg-rsa-guidance-10.html Incorporates some of the code from #680 / #702, where some of the code from the latter was merged in #739 (blinding support). Uses `cargo checkct` / BINSEC to verify constant-time operation. Closes #626
This draft PR replaces the PKCS#1 v1.5 unpad function with an implicit rejection API based on:
Issue #626
The new PKCS#1 v1.5 unpad function does not return an error if the padding is invalid.
Instead, it deterministically generates and returns a replacement random message derived from the secret key and the ciphertext.
As a result, callers cannot distinguish between valid and invalid padding based on the output, thus reducing the risk side-channel attacks.
Breaking changes:
Removes the sha2 feature flag because SHA-2 is required for the implicit rejection algorithm.
PKCS#1 v1.5 decryption no longer returns an error if the padding is invalid.
WARNING: This PR requires careful review before progressing beyond the draft stage.
TODO: The existing 0 padding function does not seem to be constant time: uint_to_zeroizing_be_pad