Subject: [perpass] RSA-OAEP

From: Russ Housley <[email-masked]>
Date: Wed, 20 Nov 2013 10:49:56 -0500

We have known for a ver long time that PKCS #1 Version 1.5 (see RFC 2313) is vulnerable to adaptive chosen ciphertext attacks when applied for encryption purposes.  Exploitation reveals the result of a particular RSA decryption, requires access to an oracle which will respond to a hundreds of thousands of ciphertexts), which are constructed adaptively in response to previously-received replies providing information on the successes or failures of attempted decryption operations.  As a result, the attack appears significantly less feasible to perpetrate in store-and-forward environments than for interactive ones.

PKCS #1 Version 2.0 and Version 2.1 (see RFC 3447) include RSA-OAEP to address this situation, but we have seen very little movement toward RSA-OAEP.  While we are reviewing algorithm choices in light of the pervasive surveillance situation, I think we should take the time to address known vulnerabilities like this one.  If we don't, then we are leaving an partially open door for a well funded attacker.

Russ

---

From: Robin Wilton <[email-masked]>
Date: Wed, 20 Nov 2013 16:03:15 +0000

+1 

A vulnerability is a vulnerability. Currently foreseeable attacks may seem unwieldy/impractical, but assuming that someone hasn't found/won't find a viable exploitation is optimistic.

R

Robin Wilton
Technical Outreach Director - Identity and Privacy
Internet Society

email: [email-masked]
Phone: +44 705 005 2931
Twitter: @futureidentity

On 20 Nov 2013, at 15:49, Russ Housley wrote:

> _______________________________________________
> perpass mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/perpass

---

From: Richard Barnes <[email-masked]>
Date: Wed, 20 Nov 2013 11:09:36 -0500

What are you proposing be done, besides supporting OAEP in new specs or
back-porting it to old ones?  In order to make people use OAEP, we would
need to call in the protocol police.

On Wed, Nov 20, 2013 at 10:49 AM, Russ Housley <[email-masked]> wrote:

> We have known for a ver long time that PKCS #1 Version 1.5 (see RFC 2313)
> is vulnerable to adaptive chosen ciphertext attacks when applied for
> encryption purposes.  Exploitation reveals the result of a particular RSA
> decryption, requires access to an oracle which will respond to a hundreds
> of thousands of ciphertexts), which are constructed adaptively in response
> to previously-received replies providing information on the successes or
> failures of attempted decryption operations.  As a result, the attack
> appears significantly less feasible to perpetrate in store-and-forward
> environments than for interactive ones.
>
> PKCS #1 Version 2.0 and Version 2.1 (see RFC 3447) include RSA-OAEP to
> address this situation, but we have seen very little movement toward
> RSA-OAEP.  While we are reviewing algorithm choices in light of the
> pervasive surveillance situation, I think we should take the time to
> address known vulnerabilities like this one.  If we don't, then we are
> leaving an partially open door for a well funded attacker.
>
> Russ

---

From: Russ Housley <[email-masked]>
Date: Wed, 20 Nov 2013 12:07:54 -0500

I do not know of any place where RSA-OAEP has been called out as the mandatory to implement algorithm, but there are many places where PKCS#1 v1.5 still enjoys this status.  I suggest we make RSA-OAEP the mandatory to implement algorithm in our specifications.

Russ

On Nov 20, 2013, at 11:09 AM, Richard Barnes wrote:

> What are you proposing be done, besides supporting OAEP in new specs or back-porting it to old ones?  In order to make people use OAEP, we would need to call in the protocol police.
> 
>

---

From: Richard Barnes <[email-masked]>
Date: Wed, 20 Nov 2013 12:18:23 -0500

That makes sense.  Would you say the same in the signature domain, i.e.,
PKCS#1 v1.5 -> PSS?

On Wed, Nov 20, 2013 at 12:07 PM, Russ Housley <[email-masked]> wrote:

> I do not know of any place where RSA-OAEP has been called out as the
> mandatory to implement algorithm, but there are many places where PKCS#1
> v1.5 still enjoys this status.  I suggest we make RSA-OAEP the mandatory to
> implement algorithm in our specifications.
>
> Russ
>
>
> On Wed, Nov 20, 2013 at 10:49 AM, Russ Housley <[email-masked]>wrote:
>

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 20 Nov 2013 17:25:33 +0000

I agree that OAEP is better and would be a better MTI.

But that's been tried, and each time, current deployment
considerations trumped it and specs choose pkcs#1v1.5.

I may well be wrong but I suspect someone putting in a
bit of concerted work on coding will be needed before
OAEP will get accepted, esp since the attacks are all
million-message attacks so far. Or am I out of date
in terms of which libraries now have OAEP in 'em?

Lastly, while that is a worthwhile and good security
thing to do, I think the linkage to pervasive
monitoring isn't that strong, so maybe this'd be a
better topic for the saag list?

S

---

From: Russ Housley <[email-masked]>
Date: Wed, 20 Nov 2013 14:00:52 -0500

OpenSSL supports RSA-OAEP and RSA-PSS.  See the latest documentation for the 'cms' command for details.  At present, PSS-only and OAEP-only keys in certificates are not supported.

Russ

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 20 Nov 2013 19:33:43 -0800

+1 to this being a SAAG topic, not a perpass topic. And it would be great
to fix it, if we can get buy-in.

---

From: Sean Turner <[email-masked]>
Date: Fri, 29 Nov 2013 23:08:52 -0500

for what it’s worth: +1 to saag

I’d like to see both OAEP and PSS be more widely adopted.

spt