diff options
| author | Emilia Kasper <emilia@openssl.org> | 2017-07-17 16:47:13 +0200 |
|---|---|---|
| committer | Emilia Kasper <emilia@openssl.org> | 2017-07-18 11:16:39 +0200 |
| commit | 1e3f62a3823f7e3db9d403f724fd9d66f5b04cf8 (patch) | |
| tree | 979f2a1a496cc1084ea475f10aef05d9d3fc028f /doc/man3/RSA_padding_add_PKCS1_type_1.pod | |
| parent | ff0426cc94df5e6dd25b8cfd6f9f7c840264a400 (diff) | |
| download | openssl-1e3f62a3823f7e3db9d403f724fd9d66f5b04cf8.zip openssl-1e3f62a3823f7e3db9d403f724fd9d66f5b04cf8.tar.gz openssl-1e3f62a3823f7e3db9d403f724fd9d66f5b04cf8.tar.bz2 | |
RSA_padding_check_PKCS1_type_2 is not constant time.
This is an inherent weakness of the padding mode. We can't make the
implementation constant time (see the comments in rsa_pk1.c), so add a
warning to the docs.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Diffstat (limited to 'doc/man3/RSA_padding_add_PKCS1_type_1.pod')
| -rw-r--r-- | doc/man3/RSA_padding_add_PKCS1_type_1.pod | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/doc/man3/RSA_padding_add_PKCS1_type_1.pod b/doc/man3/RSA_padding_add_PKCS1_type_1.pod index 52ca15a..93911ca 100644 --- a/doc/man3/RSA_padding_add_PKCS1_type_1.pod +++ b/doc/man3/RSA_padding_add_PKCS1_type_1.pod @@ -105,6 +105,13 @@ The RSA_padding_check_xxx() functions return the length of the recovered data, -1 on error. Error codes can be obtained by calling L<ERR_get_error(3)>. +=head1 WARNING + +The RSA_padding_check_PKCS1_type_2() padding check leaks timing +information which can potentially be used to mount a Bleichenbacher +padding oracle attack. This is an inherent weakness in the PKCS #1 +v1.5 padding design. Prefer PKCS1_OAEP padding. + =head1 SEE ALSO L<RSA_public_encrypt(3)>, |