sign in sign up
<<
Home , PKCS

Provable Security RSA-PKCS - Signature

Lawrence Berkeley National Lab

August 2003

David Pointcheval LIENS-CNRS Ecole normale supérieure

SSuummmmaarryy

• Encryption – PKCS #1 v1.5 – PKCS #1 v2.0 : OAEP • Signature – PKCS #1 v1.5/2.0 – PKCS #1 v2.1 : PSS • Conclusion

David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 2 SSuummmmaarryy

• Encryption ± PKCS #1 v1.5 ± PKCS #1 v2.0 : OAEP • Signature ± PKCS #1 v1.5/2.0 ± PKCS #1 v2.1 : PSS • Conclusion

David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 3

RRSSAA

Rivest - Shamir - Adleman 1978

• n=pq : public modulus en/de-cryption e : public exponent E(m) = me mod n • d=e-1 mod ϕ(n) : private D(c) = cd mod n

Relies on the so-called RSA problem: extracting e-th roots mod n

David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 4 PPllaaiinn--RRSSAA:: WWeeaakk SSeeccuurriittyy

• One-Wayness = RSA Problem • Deterministic: cannot achieve Semantic Security

Does c encrypt m0 or m1?

Re-encrypt m0, and check whether it is c • Multiplicativity: cannot prevent Chosen- Attacks e With c = Ee(m) = m mod n Compute c’ = 2e c mod n, ask for m’ Note that c’ = (2m)e mod n, thus m = m’/2 mod n ⇒ need of

David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 5

PPKKCCSS ##11 vv 11..55

Padding String EM 00 02 length ≥ 8 00 Data Block bytes ≠ 0 • Efficient encoding/decoding • Probabilistic encryption • Breaks multiplicativity • But… a random ciphertext is valid with non-negligible probability ≈ 2-16

David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 6 PPKKCCSS ##11 vv 11..55

Padding String EM 00 02 length ≥ 8 00 Data Block bytes ≠ 0

Valid ciphertext ⇒ the MSB of the encoded message is at zero ± The bit-security of RSA says that any bit of the e-th root is as hard as the whole e-th root ± Any bit-leakage is serious ± Here: 2 full bytes are leaked!

David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 7

* BBrreeaakkiinngg PPKKCCSS ##11 vv 11..55

Padding String EM 00 02 length ≥ 8 00 Data Block bytes ≠ 0 Valid ciphertext C = EMe mod n ⇒ 2 × 256k-2 ≤ EM < 3 × 256k-2 Challenge ciphertext C = EMe mod n ± Find small S such that C' = C × Se mod n valid: for some 0 < r < S, 2 × 256k-2 - rn ≤ EM S < 3 × 256k-2 - rn ⇒ EM lies in a small interval [a, b]

David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 8 * BBrreeaakkiinngg PPKKCCSS ##11 vv 11..55

Padding String EM 00 02 length ≥ 8 00 Data Block bytes ≠ 0 Choose a new S such that the sets {a S mod n, (a+1) S mod n, …, b S mod n} and [2 × 256k-2, 3 × 256k-2[ overlap Validity of C' = C Se mod n tells in which part it is ⇒ new small inverval [a', b'] for EM Approx.: any new valid ciphertext reduces the interval by 1/2

David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 9

BBrreeaakkiinngg PPKKCCSS ##11 vv 11..55

Padding String EM 00 02 length ≥ 8 00 Data Block bytes ≠ 0

• Reaction Attack (validity requests) breaks the One-Wayness • Given a challenge ciphertext c*, after a few thousand of requests c, one can recover the plaintext m*

David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 10 SSuummmmaarryy

• Encryption ± PKCS #1 v1.5 ± PKCS #1 v2.0 : OAEP • Signature ± PKCS #1 v1.5/2.0 ± PKCS #1 v2.1 : PSS • Conclusion

David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 11

OOAAEEPP Bellare-Rogaway ‘94

f a trapdoor one-way permutation (e.g. RSA) then (with G → {0,1}n and H → {0,1}?) M s M = m||0k G H EM r random r t E(m,r) : Compute a,b then c=f (s||t) = EMe mod n D(c) : Compute EM = s||t = f -1(c) = cd mod n, invert OAEP, and check redundancy

David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 12 IINNDD--CCCCAA22 uunnddeerr OOWW ooff ff

In 1994, Bellare and Rogaway proved that • the OAEP construction provides an IND-CPA under the OW of f • it is plaintext-aware (PA94) proven: IND-CPA + PA94 ⇒ IND-CCA1 But widely believed: not proven: IND-CPA + PA94 ⇒ IND-CCA2 and namely for OAEP…

David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 13

IINNDD--CCCCAA22 uunnddeerr OOWW ooff ff

In 1998, improved plaintext-awareness (PA98) proven: IND-CPA + PA98 ⇒ IND-CCA2 But… PA98 of OAEP never studied And IND-CCA2 of OAEP still widely believed under the sole OW of f and namely for RSA-OAEP RSA-OAEP: the most efficient and “provably secure” construction ⇒ became the new PKCS #1 v2.0

David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 14 IINNDD--CCCCAA22 uunnddeerr OOWW ooff ff

However, in 2000, Shoup showed a counter-example: ± a trapdoor one-way permutation f ± so that f -OAEP can be broken: malleable from a ciphertext c of an unknown message m, one can build a ciphertext c' of m' = m ⊕ 1 ⇒ break OW-CCA2, and thus IND-CCA Given a challenge c, the encryption of m, one derives the ciphertext c' of m ⊕ 1 one request to the decryption oracle is enough!

David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 15

CCoouunntteerr--EExxaammppllee *

• Let g be a trapdoor one-way permutation so that their exists an algorithm A, which on a and g(x) computes g(x ⊕ a) • Let us define f (s,t) = s || g(t), which is clearly a trapdoor one-way permutation

David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 16 MMaalllleeaabbiilliittyy *

m 0k r ⊕ δ → m’ T = H(s)⊕H(s’) G

H

s t ⊕ δ || 0k → s’ ⊕ T → t’

David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 17

MMaalllleeaabbiilliittyy ((ddeettaaiillss)) *

One receives c = E(m,r) = f (s,t) = s || g(t) where M= m ||0k, s = M ⊕ G(r), t = r ⊕ H(s) ± One gets s, and computes s' = s ⊕ ∆ for some ∆ = δ || 0k ± One computes T = H(s) ⊕ H(s'), and t' = t ⊕T as well as g(t ⊕T) granted A on g(t) and T r' = t' ⊕H(s') = t ⊕T ⊕H(s') = t ⊕H(s) = r M’ = s'⊕G(r) = s⊕∆⊕G(r) = M⊕∆ = (m⊕δ) || 0k – c' = f (s',t') is a new ciphertext: of m ⊕ δ

David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 18 PPaarrttiiaall--DDoommaaiinn OOnnee--WWaayynneessss

From c = E(m,r) = f (s,t) ⇒ c' = E(m ⊕ δ,r) for any δ of his choice • without asking G(r) ⇒ OW of f not broken • but asking H(s) ⇒ partial-domain OW of f This intuition can be made formal: Break IND-CCA2 of f -OAEP, ⇒ partially invert f Fujisaki-Okamoto-Pointcheval-Stern Crypto ‘01

David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 19

RRSSAA:: aa PPaarrttiiccuullaarr CCaassee

The RSA permutation is particular: Partial Domain One-Wayness ⇔ One-Wayness Consequence: RSA-OAEP is IND-CCA2 under the classical RSA assumption Note: Shoup repaired the proof for RSA exponent 3 only, we repaired it for any exponent

David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 20 PPKKCCSS ##11 vv 22..00

After Bleichenbacher’s attack, the OAEP construction was adopted by RSA in PKCS #1 v 2.0 (and still in v 2.1) Even if a construction is provably secure, careless implementations often lead to very weak e.g. invalidity reasons must be indistinguishable – MSB different of zero – Redundancy not satisfied

David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 21

SSuummmmaarryy

• Encryption ± PKCS #1 v1.5 ± PKCS #1 v2.0 : OAEP • Signature ± PKCS #1 v1.5/2.0 ± PKCS #1 v2.1 : PSS • Conclusion

David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 22 PPllaaiinn--RRSSAA SSiiggnnaattuurree

• n=pq : public modulus e : public exponent • d=e-1 mod ϕ(n) : private S(m) = md mod n V(m,σ) = (m = σe mod n)

Existential forgery: ± choose a random σ ± compute m = σe mod n

David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 23

PPKKCCSS ##11 vv 11..55//22..00

Padding String EM 00 01 length ≥ 8 00 Digest Info bytes ≠ 0

? S(m) = f −1(EM) V(m, ) = ( f ( = EM)

David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 24 PPKKCCSS ##11 vv 11..55//22..00

Padding String EM 00 01 length ≥ 8 00 Digest Info bytes ≠ 0

• Digest Info = HashID and H(m) It is small, and the padding string can be long… under the control of the adversary • Using the multiplicativity of RSA a weakness has been found in 1999

David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 25

* AAttttaacckk IIddeeaa

• A lot of freedom in the Padding String • Get many EMi for several i such that Π ⇒ σ Π σ EM = EMi = i After several queries to the signing oracle, one can build a new signature

David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 26 NNeeww VVeerrssiioonn

Applied on a slight variant of ISO 9796-1 But theoretical only on PKCS #1 v1.5 … less efficient than factoring!

Anyway, a provably secure construction was better.

David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 27

SSuummmmaarryy

• Encryption ± PKCS #1 v1.5 ± PKCS #1 v2.0 : OAEP • Signature ± PKCS #1 v1.5/2.0 ± PKCS #1 v2.1 : PSS • Conclusion

David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 28 PPrroobbaabbiilliissttiicc SSiiggnnaattuurree SScchheemmee Bellare-Rogaway `96

m r

k = k0 + k1 + k2 + 1 H k-1 ⊂ ⊂ k ⊕ {0,1} X {0,1} G f : X → X

0 w s t y = 0||w||s||t F σ = f -1(y)

k2 k1 k0

David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 29

RRSSAA -- PPSSSS

• n, k-bit RSA modulus (k = k0 + k1 + k2 + 1) • n,e : public • d : private key

F : {0,1}k2 → {0,1}k0 and G : {0,1}k2 → {0,1}k1 H : {0,1}* → {0,1}k2

w = H (m,r), s = G(w) ⊕ r,t = F(w) y = 0 w s t and = y d mod n

David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 30 RRSSAA -- PPSSSS

• Provably secure no existential forgeries under chosen-message attacks • Efficient security proof ⇒ practical security • Probabilistic ⇒ PKCS #1 v2.1

David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 31

SSuummmmaarryy

• Encryption ± PKCS #1 v1.5 ± PKCS #1 v2.0 : OAEP • Signature ± PKCS #1 v1.5/2.0 ± PKCS #1 v2.1 : PSS • Conclusion

David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 32 CCoonncclluussiioonn

Almost all the previously defined paddings, without any security proof, have been showed to be flawed Any new standard (ISO, IEEE, IETF, PKCS, …) needs a security proof

David Pointcheval Provable Security - RSA-PKCS - Encryption-Signature - 33