Re: [pkcs11] RE: Proposal for recommendation/best practice on protection against Padded Oracle attacks

[Wan-Teh Chang <wtc@google.com>]

On Mon, Jun 24, 2013 at 7:12 AM, Duane, Chris <chris.duane@rsa.com> wrote:
>
> A concern was raised on the wiki around extraction attacks (more
> specifically a padded oracle/Bleichenbaucher style attack).

Nit: this attack is usually called a "padding oracle" as opposed to a
"padded oracle".

> I propose a suggested best practice/recommendation of:
>
>  "To protect against chosen ciphertext attacks, like the Bleichenbacher
> attack, use PKCS #1 Version 2, with OAEP, and disable support for PKCS #1,
> Version 1.5."

This is a good recommendation in general. You may want to point out
that TLS (versions 1.0 - 1.2) still uses PKCS #1 v1.5 encryption for
the cipher suites that use the RSA key exchange method.

Wan-Teh Chang