I found in my searches that the padding oracle attack can be used against the RSA with PKCS1PAdding or OAEP padding, and I used this algorithm for a symmetric key exchange.
How can I prevent a padding oracle attack when using public keys for secret key exchange? Encrypt-then-MAC cannot be used because generating the MAC needs a shared secret key, and the key has not been exchanged yet.


The "padding oracle" attack you are talking about is better known as Bleichenbacher's attack against RSA. The attacker sends malformed encrypted keys; some will still (by pure chance) happen to decrypt properly, albeit with a decrypted content that the attacker cannot know. If the server's behaviour changes, depending on whether the decryption failed ("bad padding") or not (server uses the decryption result and keeps going), then the attacker can obtain some information on the RSA private key.

A common workaround is to, indeed, hide the behavioural change: when the decryption fails, the server simply uses a random value instead of the decryption result. Thus, the attacker can no longer distinguish between "bad padding" and "padding was correct and resulted in some random decrypted junk". This is, in fact, rather hard to implement properly, especially since industrious attackers can apply timing attacks and notice when the server used a random replacement, because of the extra time needed to generate the replacement.

OAEP is nominally immune to Bleichenbacher's attack, and was designed precisely in that goal; however, this still requires that it is implemented correctly, which is, again, not as easy as it seems. The usual recommendation applies: if you are writing your own crypto protocol or implementation, then you are doing it wrong. You should use an existing protocol, and existing implementations where details such as resistance to timing attacks have been explored and fixed through years of on-field testing.

  • Thanks for response. Is OAEP implemented correctly in JSSE in JDK 7 or 8? – hyda May 20 '15 at 5:38
  • @hyda JSSE implements standard SSL/TLS which does not use OAEP, so JSSE does not implement OAEP. SunJCE among other things implements RSA encryption with OAEP according to PKCS#1v2, AFAIK correctly. – dave_thompson_085 May 23 '15 at 23:31
  • @Tom Leek, Is RSA-KEM Vulnerable to Padding Oracle Attack? – hyda May 24 '15 at 11:23
  • RSA-KEM uses no padding (that's its point) so it should be immune to padding oracle attacks. The random integer from which the key is derived must still be generated in the proper range with enough "uniform randomness". PKCS#1 preferred OAEP over KEM because the security proofs were "tighter" in all generality. – Tom Leek May 25 '15 at 19:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.