5 ms·

How is this relevant in the context of setting up a connection protected by DH and RSA? Yes, it would be a problem any time you decrypt RSA. So pgp is tricky, b

by phicoh 10y ago

How is this relevant in the context of setting up a connection protected by DH and RSA? Yes, it would be a problem any time you decrypt RSA. So pgp is tricky, but setting up a ssh or tls connection without DH is beyond foolish. For signature verification, there is no way that an adversary can gain anything by inserting a padding violation. Assuming properly authenticated data, then decrypting without checking padding is no problem. For RSA encryption, padding only protects the sender. By itself RSA encryted data cannot be trusted, you need separate integrity protection for that.

benchaney 10y ago
There are attacks against RSA signatures when padding is omittted.
- phicoh 10y ago
  Obviously. But for checking the padding on a signature you only need the public key. So you cannot leak any sensitive RSA key material while checking the padding.
  - tptacek 10y ago
    Padding attacks don't leak key material; they leak plaintext.
    - benchaney 10y ago
      Well in this case they potentially allow forgeries, but yes.
    - phicoh 10y ago
      Right an attack on an RSA signature that leaks plain text. Really? Must be a super secret signature then.
      - tptacek 10y ago
        You should familiarize yourself with how RSA works, and what an RSA signature is.