Subject: Re: [TLS] Using RSA PSS in TLS

From: Peter Gutmann <[email-masked]>
Date: Sun, 18 Jan 2015 02:47:38 +0000

Watson Ladd <[email-masked]> writes:

>RSA-OEAP has similar error oracle issues,

That's one thing I noticed when I implemented it some time ago, OAEP is an
absolute goldmine (or minefield) of oracles.  PKCS 1.5 is just a
straightforward walk-down-the-byte-string check while OAEP requires multiple
complex steps to decode/check it, even with very careful ordering of the
checks you do to make sure there's very little time difference between them
(including deferring checks to cluster them around the same time and similar
steps) you can't really create an oracle-free implementation.

Peter.

---

From: Peter Gutmann <[email-masked]>
Date: Thu, 22 Jan 2015 08:16:01 +0000

Martin Rex <[email-masked]> writes:

>Btw. TLSv1.2 explicitly requires support for a slight variation (NULL and
>absent parameters) on the TLSv1.2 RSA PKCS#1 v1.5 digitally-signed signature
>verification, see rfc5246, section 4.7 3rd paragraph:

That looks like another one of those bits of TLS 1.2 that implementers have to
know to ignore...

Peter.