Cryptology Academy · Lesson

PKCS#1 v1.5 Padding & Bleichenbacher

Explain adaptive chosen-ciphertext attacks on PKCS#1 v1.5.

Lesson 2 of 413 steps

PKCS#1 v1.5 Padding & Bleichenbacher is a free Cryptology Academy lesson on CoddyKit. This is lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cryptology Academy learning path, and your progress syncs across the web and the CoddyKit app. The Cryptology Academy course includes 4 lessons in total.

Welcome

PKCS#1 v1.5 padding was the dominant RSA padding standard for 20 years. In 1998, Daniel Bleichenbacher showed it was vulnerable to an adaptive chosen-ciphertext attack.

PKCS#1 v1.5 Structure

Format: 0x00 0x02 [random non-zero bytes] 0x00 [message] The 0x00 0x02 prefix indicates encryption padding (vs 0x00 0x01 for signing). Random bytes prevent determinism and must not be zero.

Why PKCS#1 v1.5 Was Used

PKCS#1 v1.5 was designed by RSA Security in 1993, well before IND-CCA2 security proofs existed. It added randomness and structure checks. Widely deployed in SSL/TLS from 1995 onward.

The Bleichenbacher Attack

Bleichenbacher (1998): if a server reveals whether RSA decryption produces valid PKCS#1 v1.5 padding (via error message or timing), an attacker can decrypt any RSA-encrypted value with ~1 million queries.

Oracle Definition

A 'padding oracle' is any side channel that distinguishes 'valid padding' from 'invalid padding'. Even a tiny timing difference or a different error message creates an exploitable oracle.

The Attack Mechanics

The attacker multiplies the target ciphertext C by s^e mod n and sends modified C×s^e. If the server responds 'valid padding', s was chosen correctly. Iterating narrows the possible plaintext range until M is recovered.

DROWN Attack (2016)

DROWN exploited Bleichenbacher via SSLv2. Modern TLS servers sharing a key with any SSLv2 server were vulnerable. Decrypted RSA key exchanges of modern TLS using SSLv2 as the oracle. 33% of HTTPS servers affected.

Robot Attack (2017)

ROBOT (Return Of Bleichenbacher's Oracle Threat): rediscovered timing oracles in 7 of the 10 most popular TLS implementations, including Cisco, F5, and Radware. Bleichenbacher survives because implementations are hard.

Constant-Time RSA Decryption

Defenses: always proceed with decryption regardless of padding validity; return an identical response on invalid padding. Use constant-time code to prevent timing differences. Difficult to implement correctly.

Why OAEP Replaced v1.5

OAEP includes a trapdoor one-way hash that proves IND-CCA2 security (chosen-ciphertext secure). Even with a padding oracle, OAEP's randomized structure makes oracle queries uninformative.

Legacy Systems Still Use v1.5

Despite OAEP's existence, PKCS#1 v1.5 survives in legacy payment systems, older Java apps, and certain PKI implementations. TLS 1.3 completely removed RSA key exchange, eliminating this attack surface.

Quick Check

What is a 'padding oracle' in the context of the Bleichenbacher attack?

Answer it in the interactive lesson

Recap

Bleichenbacher's attack is a landmark in practical cryptanalysis. Next we study OAEP — the provably secure padding that replaces v1.5.

Free to start

Learn Cryptology Academy with an AI tutor — free

Write and run real code in your browser, get instant help from a 24/7 AI tutor, and pick up where you left off on the web or in the app.

Courses: 67
Lessons: 261

Start learning free View the full course

Frequently Asked Questions

Is the “PKCS#1 v1.5 Padding & Bleichenbacher” lesson free?

Yes — the full text of “PKCS#1 v1.5 Padding & Bleichenbacher” is free to read here on the web. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cryptology Academy course, upgrade to CoddyKit PRO. The Cryptology Academy course includes 4 lessons in total.

What will I learn in “PKCS#1 v1.5 Padding & Bleichenbacher”?

Explain adaptive chosen-ciphertext attacks on PKCS#1 v1.5. You practise Cryptology Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cryptology Academy?

No prior experience is required. Cryptology Academy on CoddyKit is structured for beginners through advanced learners, so you can start here or from the beginning and move at your own pace. This is lesson 2 of 4.

How long does the “PKCS#1 v1.5 Padding & Bleichenbacher” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cryptology Academy lesson?

Yes. Every Cryptology Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

Textbook RSA & Why It Is Insecure
PKCS#1 v1.5 Padding & Bleichenbacher
OAEP: Optimal Asymmetric Encryption Padding
RSA-PSS for Digital Signatures

← Back to Cryptology Academy