Subject: [Uta] FYI: improved attack against RSA PKCS1.5

From: Kohei Kasamatsu <[email-masked]>
Date: Fri, 07 Mar 2014 20:57:29 +0900

Hi UTA folks,

I'm kohei kasamatsu

[1] is improved attack against RSA PKCS1.5 by Bleichenbacher.
I think that it is better to consider it in draft-sheffer-tls-bcp.

I recommend use of CCA secure public key encryption (variant of RSA)  as
the countermeasure. (e.x. RSA-OAEP)

[1] Romain Bardou, Riccardo Focardi, Yusuke Kawamoto, Lorenzo Simionato,
Graham Steel, Joe-Kai Tsay: Efficient Padding Oracle Attacks on
Cryptographic Hardware. CRYPTO 2012: 608-625

 paper: http://eprint.iacr.org/2012/417
 slide: https://www.iacr.org/conferences/crypto2012/slides/11-1-Steel.pdf

Best,
-- 
Kohei KASAMATSU

NTT Software Corporation
TEL: +81 45 212 7908 FAX: +81 45 212 9800
E-mail: [email-masked]

---

From: Yaron Sheffer <[email-masked]>
Date: Sat, 08 Mar 2014 08:24:05 +0200

Hi Kohei,

Thanks for describing this attack. I guess the original Bleichenbacher 
attack and its derivatives do belong in the Attacks draft.

Sec. 7.4.7.1 of RFC 5246 (TLS 1.2) claims to be resistant to the 
Bleichenbacher attack, and as far as I understand your new attack 
improves the performance of that attack, but makes the same assumptions 
on the protocol as the older attack. Can you comment on the security of 
TLS 1.2 (or older versions) against your attack?

Thanks,
	Yaron