PKCS#1 v1.5 Padding & Bleichenbacher
Explain adaptive chosen-ciphertext attacks on PKCS#1 v1.5.
Welcome
PKCS#1 v1.5 padding was the dominant RSA padding standard for 20 years. In 1998, Daniel Bleichenbacher showed it was vulnerable to an adaptive chosen-ciphertext attack.
PKCS#1 v1.5 Structure
Format: 0x00 0x02 [random non-zero bytes] 0x00 [message]
The 0x00 0x02 prefix indicates encryption padding (vs 0x00 0x01 for signing).
Random bytes prevent determinism and must not be zero.
All lessons in this course
- Textbook RSA & Why It Is Insecure
- PKCS#1 v1.5 Padding & Bleichenbacher
- OAEP: Optimal Asymmetric Encryption Padding
- RSA-PSS for Digital Signatures