Skip to content

Commit 8686d52

Browse files
authored
Document that PKCS1v1.5 is not constant time (#5600)
closes #5510
1 parent 1be144a commit 8686d52

File tree

2 files changed

+25
-0
lines changed

2 files changed

+25
-0
lines changed

docs/hazmat/primitives/asymmetric/rsa.rst

+5
Original file line numberDiff line numberDiff line change
@@ -342,6 +342,11 @@ Padding
342342
:class:`OAEP` should be preferred for encryption and :class:`PSS` should be
343343
preferred for signatures.
344344

345+
.. warning::
346+
347+
Our implementation of PKCS1 v1.5 decryption is not constant time. See
348+
:doc:`/limitations` for details.
349+
345350

346351
.. function:: calculate_max_pss_salt_length(key, hash_algorithm)
347352

docs/limitations.rst

+20
Original file line numberDiff line numberDiff line change
@@ -20,5 +20,25 @@ like almost all software in Python is potentially vulnerable to this attack. The
2020
Likelihood: unlikely, Remediation Cost: expensive to repair" and we do not
2121
consider this a high risk for most users.
2222

23+
RSA PKCS1 v1.5 constant time decryption
24+
---------------------------------------
25+
26+
RSA decryption has several different modes, one of which is PKCS1 v1.5. When
27+
used in online contexts, a secure protocol implementation requires that peers
28+
not be able to tell whether RSA PKCS1 v1.5 decryption failed or succeeded,
29+
even by timing variability.
30+
31+
``cryptography`` does not provide an API that makes this possible, due to the
32+
fact that RSA decryption raises an exception on failure, which takes a
33+
different amount of time than returning a value in the success case.
34+
35+
For this reason, at present, we recommend not implementing online protocols
36+
that use RSA PKCS1 v1.5 decryption with ``cryptography`` -- independent of this
37+
limitation, such protocols generally have poor security properties due to their
38+
lack of forward security.
39+
40+
If a constant time RSA PKCS1 v1.5 decryption API is truly required, you should
41+
contribute one to ``cryptography``.
42+
2343
.. _`Memory wiping`: https://devblogs.microsoft.com/oldnewthing/?p=4223
2444
.. _`CERT secure coding guidelines`: https://wiki.sei.cmu.edu/confluence/display/c/MEM03-C.+Clear+sensitive+information+stored+in+reusable+resources

0 commit comments

Comments
 (0)