0Pricing
Cryptology Academy · Lesson

PKCS#1 v1.5 Padding & Bleichenbacher

Explain adaptive chosen-ciphertext attacks on PKCS#1 v1.5.

PKCS#1 v1.5 Padding & Bleichenbacher is a free Cryptology Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cryptology Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Welcome

PKCS#1 v1.5 padding was the dominant RSA padding standard for 20 years. In 1998, Daniel Bleichenbacher showed it was vulnerable to an adaptive chosen-ciphertext attack.

PKCS#1 v1.5 Structure

Format: 0x00 0x02 [random non-zero bytes] 0x00 [message] The 0x00 0x02 prefix indicates encryption padding (vs 0x00 0x01 for signing). Random bytes prevent determinism and must not be zero.

Why PKCS#1 v1.5 Was Used

PKCS#1 v1.5 was designed by RSA Security in 1993, well before IND-CCA2 security proofs existed. It added randomness and structure checks. Widely deployed in SSL/TLS from 1995 onward.

The Bleichenbacher Attack

Bleichenbacher (1998): if a server reveals whether RSA decryption produces valid PKCS#1 v1.5 padding (via error message or timing), an attacker can decrypt any RSA-encrypted value with ~1 million queries.

Oracle Definition

A 'padding oracle' is any side channel that distinguishes 'valid padding' from 'invalid padding'. Even a tiny timing difference or a different error message creates an exploitable oracle.

The Attack Mechanics

The attacker multiplies the target ciphertext C by s^e mod n and sends modified C×s^e. If the server responds 'valid padding', s was chosen correctly. Iterating narrows the possible plaintext range until M is recovered.

DROWN Attack (2016)

DROWN exploited Bleichenbacher via SSLv2. Modern TLS servers sharing a key with any SSLv2 server were vulnerable. Decrypted RSA key exchanges of modern TLS using SSLv2 as the oracle. 33% of HTTPS servers affected.

Robot Attack (2017)

ROBOT (Return Of Bleichenbacher's Oracle Threat): rediscovered timing oracles in 7 of the 10 most popular TLS implementations, including Cisco, F5, and Radware. Bleichenbacher survives because implementations are hard.

Constant-Time RSA Decryption

Defenses: always proceed with decryption regardless of padding validity; return an identical response on invalid padding. Use constant-time code to prevent timing differences. Difficult to implement correctly.

Why OAEP Replaced v1.5

OAEP includes a trapdoor one-way hash that proves IND-CCA2 security (chosen-ciphertext secure). Even with a padding oracle, OAEP's randomized structure makes oracle queries uninformative.

Legacy Systems Still Use v1.5

Despite OAEP's existence, PKCS#1 v1.5 survives in legacy payment systems, older Java apps, and certain PKI implementations. TLS 1.3 completely removed RSA key exchange, eliminating this attack surface.

Quick Check

What is a 'padding oracle' in the context of the Bleichenbacher attack?

Recap

Bleichenbacher's attack is a landmark in practical cryptanalysis. Next we study OAEP — the provably secure padding that replaces v1.5.

Frequently asked questions

Is the “PKCS#1 v1.5 Padding & Bleichenbacher” lesson free?

Yes — the full text of “PKCS#1 v1.5 Padding & Bleichenbacher” is free to read here on the web, and the Cryptology Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cryptology Academy course, upgrade to CoddyKit PRO.

What will I learn in “PKCS#1 v1.5 Padding & Bleichenbacher”?

Explain adaptive chosen-ciphertext attacks on PKCS#1 v1.5. You practise Cryptology Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cryptology Academy?

No prior experience is required. Cryptology Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “PKCS#1 v1.5 Padding & Bleichenbacher” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cryptology Academy lesson?

Yes. Every Cryptology Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Textbook RSA & Why It Is Insecure
  2. PKCS#1 v1.5 Padding & Bleichenbacher
  3. OAEP: Optimal Asymmetric Encryption Padding
  4. RSA-PSS for Digital Signatures
← Back to Cryptology Academy