Padding implementation is not constant-time
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Needs clarification
- Activity status
- Quiet
- Tech stack
- rust
- Domain
- cryptography, security
Research direction
Review this crate's RSA padding-mode implementation alongside the RSA guidance draft and the Marvin Toolkit analysis linked in the issue. Focus on PKCS#1 v1.5 depadding and error handling, then use static analysis and Marvin Toolkit results to verify that the implementation follows constant-time guidance and avoids the reported sidechannels.
Written by the indexing model from the issue text.
Description
This is a followup to #19, which was originally about the modular exponentiation implementation not being constant-time, and also became our general tracking issue for the subsequent Marvin Attack.
We've gone to great lengths in crypto-bigint to produce the closest thing we can to a constant-time implementation of modular exponentiation, and while we still need to e.g. verify that's truly the case via static analysis tooling, based on the latest analysis from the Marvin Toolkit it seems like the remaining sidechannels in our implementation are probably no longer coming from crypto-bigint, but are instead in this crate's implementation of RSA padding modes.
PKCS#1 v1.5 in particular notably has a long history of sidechannels going back to Bleichenbacher's original 1998 attack, and attacks like Marvin can be seen as an evolution of that attack.
This I-D contains guidance for implementing RSA in constant-time, including things like handling depadding errors using strategies like implicit rejection:
https://datatracker.ietf.org/doc/draft-irtf-cfrg-rsa-guidance/
- Dominant language
- Rust
- Stars
- 673
- Forks
- 190
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from RustCrypto/RSA
-
Bump MSRV to 1.89 Open
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
RustCrypto/RSA#707 · 2 comments · 1 reaction ·
-
Difficulty 3/5 Half a day Newbie friendliness 74/100
RustCrypto/RSA#703 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
RustCrypto/RSA#686 · 4 comments ·
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
RustCrypto/RSA#647 · 9 comments · 1 reaction ·
-
broken rust docs Open
Difficulty 4/5 3-5 days Newbie friendliness 35/100
RustCrypto/RSA#641 · 3 reactions ·
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
kwakseongjae/auto-hwp#319 ·
-
area:cli bug filter-quality good first issue priority:medium
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
Difficulty 1/5 Under an hour Newbie friendliness 72/100
bevyengine/bevy#25861 ·
-
comp-datalake
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
ClickHouse/ClickHouse#121222 ·
-
enhancement remote
Difficulty 2/5 1-3 hours Newbie friendliness 68/100