@@ -20,5 +20,25 @@ like almost all software in Python is potentially vulnerable to this attack. The
20
20
Likelihood: unlikely, Remediation Cost: expensive to repair" and we do not
21
21
consider this a high risk for most users.
22
22
23
+ RSA PKCS1 v1.5 constant time decryption
24
+ ---------------------------------------
25
+
26
+ RSA decryption has several different modes, one of which is PKCS1 v1.5. When
27
+ used in online contexts, a secure protocol implementation requires that peers
28
+ not be able to tell whether RSA PKCS1 v1.5 decryption failed or succeeded,
29
+ even by timing variability.
30
+
31
+ ``cryptography `` does not provide an API that makes this possible, due to the
32
+ fact that RSA decryption raises an exception on failure, which takes a
33
+ different amount of time than returning a value in the success case.
34
+
35
+ For this reason, at present, we recommend not implementing online protocols
36
+ that use RSA PKCS1 v1.5 decryption with ``cryptography `` -- independent of this
37
+ limitation, such protocols generally have poor security properties due to their
38
+ lack of forward security.
39
+
40
+ If a constant time RSA PKCS1 v1.5 decryption API is truly required, you should
41
+ contribute one to ``cryptography ``.
42
+
23
43
.. _`Memory wiping` : https://devblogs.microsoft.com/oldnewthing/?p=4223
24
44
.. _`CERT secure coding guidelines` : https://wiki.sei.cmu.edu/confluence/display/c/MEM03-C.+Clear+sensitive+information+stored+in+reusable+resources
0 commit comments