Design an API for safer RSA PKCS#1v1.5 decryption of session keys

[alex]

To protect against bleichbacher attackers. Probably modeled on https://golang.org/pkg/crypto/rsa/#DecryptPKCS1v15SessionKey

[tomato42]

Alternatively, something like RSA_padding_check_PKCS1_type_2 from OpenSSL https://github.com/openssl/openssl/blob/master/crypto/rsa/rsa_pk1.c#L170

[tomato42]

@alex how users will know that they need to contribute a safe implementation?

[alex]

We've tried to lay out clearly in the docs the contexts in which this is required. If you think there's room to improve the docs, we're happy to make changes.

[tomato42]

@alex yes, it's clear and it's arguably correct; the problem is that unless there's an unfixed CVE, dependents generally don't look into the state of libraries they depend on

so they will continue to use a known unsafe API without knowing that it is unsafe

[alex]

That was always going to be the case: You can't have a constant-time API that works the way our current API does, you need a dedicated API for the session key use case, like Go does. So users in these contexts were always going to need to take some specific action.

If there are libraries implementing, for example, TLS with RSA key exchange on top of cryptography, the correct thing is to obtain a CVE against them and then work with us to implement this API.

After research @reaperhulk and I decided that because RSA key exchange is so disfavored for a multitude of reasons, we were not inclined to invest in this unless there was a compelling and concrete use case.

[tomato42]

@alex so you don't think that the design I described in openssl/openssl#13421 would work? can you say why?

[alex]

I'm generally disinclined for us to have a completely novel mitigation that changes our public API.

…

On Mon, Dec 7, 2020 at 11:31 AM Hubert Kario ***@***.***> wrote: @alex <https://github.com/alex> so you don't think that the design I described in openssl/openssl#13421 <openssl/openssl#13421> would work? can you say why? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#5510 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAAGBFYY7YDM3E3MWTAH4TSTT7NFANCNFSM4S6ZMMGQ> .

-- All that is necessary for evil to succeed is for good people to do nothing.

[tomato42]

@alex "novel" - fair enough
"changes our public API" - how? a malformed RSA ciphertext doesn't guarantee a decryption failure