Manger’s Attack Revisited

Abstract

Abstract. In this work we examine a number of different open source implementations of the RSA Optimal Asymmetric Encryption Padding (OAEP) and generally RSA with respect to the message-aimed timing attack introduced by James Manger in CRYPTO 2001. We show the shortcomings concerning the countermeasures in two libraries for personal computers, and address potential flaws in previously proposed countermeasures. Furthermore, we point out a new source of timing differences that has not been addressed previously. We also investigate a new class of related problems in the multi-precision integer arithmetic that in principle allows a variant of Manger's attack to be launched against RSA implementations on 8-bit and possibly 16-bit platforms.

Certified computer-aided cryptography

“…• to remedy the fact that RSA is not a random permutation over the entire encoded message space, the standard ensures that it is always called on plaintexts whose first byte is zero; this has an incidence on the security and the proof. • finally, the standard permits the encryption of variable (but bounded) length messages, using some additional padding to fixed length; this does not affect theoretical security, but has led to well-known padding oracle attacks [27,33] when implemented carelessly.…”

Message-aimed side channel and fault attacks against public key cryptosystems with homomorphic properties

“…In [25], it is discussed that other sources for timing differences based on the existence of such a supernumerary octet can be found in the integer to octet string conversion that precedes the OAEP decoding operation. This is due to the fact that these conversion routines generally iterate over the octets of the encoded integer.…”

“…Here, according to [25], the encoding routines running time depends on the number of octets needed to represent the RSA message. In the case of McEliece, such a vulnerability is rather inconceivable in a reasonable implementation.…”