4 ms·
While timing attacks are not one of the ways RSA is more error-prone, it is still more error-prone, particularly regarding client secret selection.
by pie_flavor 3y ago
While timing attacks are not one of the ways RSA is more error-prone, it is still more error-prone, particularly regarding client secret selection.
- coppsilgold 3y agoThat is only because the way RSA key exchange has been implemented everywhere involves padding. RSA-KEM[1] has been available since forever and no padding is required, though no one uses it for some reason. RSA-KEM is also trivial to implement as it's virtually identical to textbook RSA, with the sole restriction that m has to be randomly sampled from 1 .. n-1. And just like that, no padding oracles. [1] <https://en.wikipedia.org/wiki/Key_encapsulation_mechanism https://en.wikipedia.org/wiki/Key_encapsulation_mechanism> , <https://datatracker.ietf.org/doc/html/rfc5990 https://datatracker.ietf.org/doc/html/rfc5990>