Chosen ciphertext attacks against protocols based on the RSA encryption standard PKCS #1

Abstract

This paper introduces a new adaptive chosen ciphertext attack against certain protocols based on RSA. We show that an RSA private-key operation can be performed if the attacker has access to an oracle that, for any chosen ciphertext, returns only one bit telling whether the ciphertext corresponds to some unknown block of data encrypted using PKCS ~1. An example of a protocol susceptible to our attack is SSL V.3.0.

RSA-OAEP Is Secure under the RSA Assumption

“…She may, furthermore, have access to more information, modeled by partial or full access to some oracles: a plaintext-checking oracle which, on input of a pair (m, c), answers whether c encrypts the message m. This attack has been named the Plaintext-Checking Attack [11]; a validity-checking oracle which, on input of a ciphertext c, just answers whether it is a valid ciphertext. This weak oracle (involved in the reaction attacks [8]) had been enough to break some famous encryption schemes [4,9], namely PKCS #1 v1.5; or the decryption oracle itself, which on the input of any ciphertext, except the challenge ciphertext, responds with the corresponding plaintext (non-adaptive/adaptive chosen-ciphertext attacks [10,12]). The latter, the adaptive chosen-ciphertext attack denoted CCA2, is clearly the strongest one.…”

An Attack on CFB Mode Encryption as Used by OpenPGP

“…The ciphertexts can be adaptively chosen so that information on previous decryptions is available before the next chosen ciphertext is submitted. These attacks have been used in the past to attack the RSA PKCS #1 v1.5 [12] encryption scheme [3], the Cipher-Block-Chaining (CBC) Mode of encryption when used with certain exploitable redundancies (e.g. padding schemes) [2,5,15,16,17] and the OpenPGP CFB mode [13,11,14] itself.…”

Attacking RSA-Based Sessions in SSL/TLS

“…Since its complete description is far beyond the scope of this article, we refer interested readers to the excellent book [10] for further details. In 1998 Bleichenbacher showed that the concrete encoding method called EME-PKCS1-v1_5, which is also employed in the SSL/TLS protocols, is highly vulnerable to chosen ciphertext attacks [1]. The attack assumes that information about the course of the decoding process is leaking to an attacker.…”

“…In this paper we present this attack. It turns out that the version number, which was initially believed to rule out the original attack [1], even allows a relatively optimized variant of the attack if the version number check is badly implemented. Our practical tests showed that among hundreds of SSL/TLS servers randomly chosen from the Internet, two thirds of them were vulnerable to our attack (for details see §4.3).…”

“…The BVO is then used for mounting our attack in §3. The attack is based on an extended variant of Bleichanbacher's algorithm from [1]. The complexity of the attack together with the statistics of the vulnerable servers found on the Internet are given in §4.…”