3 ms·

Obviously. But for checking the padding on a signature you only need the public key. So you cannot leak any sensitive RSA key material while checking the paddin

by phicoh 10y ago

Obviously. But for checking the padding on a signature you only need the public key. So you cannot leak any sensitive RSA key material while checking the padding.

tptacek 10y ago
Padding attacks don't leak key material; they leak plaintext.
- benchaney 10y ago
  Well in this case they potentially allow forgeries, but yes.
- phicoh 10y ago
  Right an attack on an RSA signature that leaks plain text. Really? Must be a super secret signature then.
  - tptacek 10y ago
    You should familiarize yourself with how RSA works, and what an RSA signature is.