Document summary
This document specifies additions and amendments to RFC 8017, "PKCS #1: RSA
Cryptography Specifications". Its primary purpose is to provide concrete
guidance to implementers on protecting RSA implementations against a wide range
of side-channel attacks. The document also formally deprecates the
RSAES-PKCS-v1_5 encryption scheme for all new protocols, citing its inherent
fragility. However, for legacy systems where removing PKCS#1 v1.5 is not
feasible, it provides a novel and robust alternative depadding algorithm based
on implicit rejection. This mechanism is designed to mitigate
Bleichenbacher-style padding oracle attacks that arise from vulnerable APIs.
The overall goal of the specification is to significantly increase the security
and robustness of RSA implementations in practice. This document is a product
of the Crypto Forum Research Group (CFRG) in the IRTF.
Research Group Summary
The document has undergone extensive review within the CFRG. Prior to the
Research Group Last Call (RGLC), the draft was formally reviewed by two members
of the Crypto Review Panel: Jon Callas and Scott Fluhrer. Their comments were
fully addressed in version -04 of the draft. A 3-week RGLC was initiated for
version -04 in August 2025. The document received strong support for
publication. During the RGLC, a very detailed review was provided by Maximilian
Lorlacks from an implementer's perspective, which led to a productive
discussion with the author. The feedback resulted in numerous editorial
improvements and clarifications, which were incorporated into version -05 of
the draft. Further minor clarifications from Jeffrey Goldberg were addressed in
version -06. All comments were fully processed, and no issues were left
unresolved. The RGLC concluded successfully in September 2025.
Document Quality
The guidance in this document is supported by a public reference implementation
of the proposed implicit rejection mechanism, available in the author's
tlslite-ng Python library [1]. This implementation served to generate the
comprehensive set of test vectors included in the document's appendix,
demonstrating the practicality and correctness of the proposed algorithms.
While the Python code serves as an excellent algorithmic blueprint, the
document notes that true constant-time properties depend on the specific
language, compiler, and hardware environment. Implicit rejection for
RSAES-PKCS-v1_5 was made in OpenSSL [2], starting from version 3.2.0, and
Mozilla [3], starting from version 3.61. No IPR disclosures related to the
described techniques have been made, and the participants are not aware of any
IPR that would encumber the implementation of this guidance.
Personnel
Stanislav Smyshlyaev is the Document Shepherd.
Colin Perkins is the IRTF Chair.
[1]
https://github.com/tlsfuzzer/tlslite-ng/blob/master/tlslite/utils/python_rsakey.py
[2] https://github.com/openssl/openssl/pull/13817 [3]
https://bugzilla.mozilla.org/show_bug.cgi?id=1651411