[MASWE-0023] Weak Padding #2922
Conversation
Co-authored-by: Carlos Holguera <[email protected]>
Co-authored-by: Carlos Holguera <[email protected]>
Co-authored-by: Carlos Holguera <[email protected]>
Co-authored-by: Carlos Holguera <[email protected]>
Co-authored-by: Carlos Holguera <[email protected]>
Co-authored-by: Carlos Holguera <[email protected]>
Co-authored-by: Carlos Holguera <[email protected]>
| - NoPadding | ||
| - PKCS1-v1_5 | ||
| status: draft | ||
|
|
||
| --- |
There was a problem hiding this comment.
| --- | |
| status: new | |
| --- |
| --- | ||
|
|
||
| ## Overview | ||
|
|
||
| Outdated or weak padding schemes, such as PKCS1v1.5 or other padding schemes that fail to comply with secure standards, such as NIST SP 800-56B are not recommended for use. These padding schemes include vulnerabilities that may allow attackers to undermine security mechanisms, such as padding oracle attacks. |
There was a problem hiding this comment.
is NIST SP 800-56B the right one? Please double check and add an inline link.
Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography
This Recommendation specifies key-establishment schemes using integer factorization cryptography (in particular, RSA). Both key-agreement and key transport schemes are specified for pairs of entities, and methods for key confirmation are included to provide assurance that both parties share the same keying material. In addition, the security properties associated with each scheme are provided.
There was a problem hiding this comment.
Also please add an inline link for "padding oracle attacks"
| Weak padding schemes can completely undermine the security of the cryptographic algorithms, exposing sensitive data to attackers, and making systems vulnerable to various attacks. This can lead to: | ||
|
|
There was a problem hiding this comment.
We don't require intros here.
| Weak padding schemes can completely undermine the security of the cryptographic algorithms, exposing sensitive data to attackers, and making systems vulnerable to various attacks. This can lead to: |
| - **Data breaches**: Weak padding can lead to unauthorized access to sensitive data, resulting in data breaches. | ||
| - **Loss of data integrity**: Padding attacks may aid attackers in manipulating ciphertext, leading to unauthorized data modifications. | ||
| - **Compromised confidentiality**: Weak padding may aid attackers in recovering plaintext from encrypted data. |
There was a problem hiding this comment.
We need to shortly explain how each thing could happen.
This PR closes #2587.