Package org.bouncycastle.operator.bc

Class BcRSAAsymmetricKeyUnwrapper

  • All Implemented Interfaces:
    KeyUnwrapper
    public class BcRSAAsymmetricKeyUnwrapper
extends BcAsymmetricKeyUnwrapper
    Lightweight unwrapper for RSA PKCS#1 v1.5 (rsaEncryption) key transport, used by the BC CMS / PKIX recipient implementations.

    Bleichenbacher/Marvin note: PKCS#1 v1.5 RSA decryption is inherently vulnerable to adaptive chosen-ciphertext (Bleichenbacher / Marvin) attacks whenever an attacker can submit ciphertexts and distinguish a padding failure from a success -- including only by timing or observable behaviour. This unwrapper reports a decryption/padding failure by throwing (an OperatorException) rather than returning a random key of the expected length, so a service that decrypts attacker-supplied key-transport blobs with a static RSA private key and exposes the outcome (a distinguishable error, or a response-time difference) acts as such an oracle. The lightweight PKCS1Encoding offers a constant-time random-fallback mode (return a random key of the expected length on bad padding instead of throwing); the BC TLS stack wires it for the RSA key-exchange pre-master secret, but it is not applied here, so padding-oracle resistance for CMS/PKIX key transport is left to the protocol or application layer. Where this unwrapper backs an online decryption oracle, prefer RSA-KEM or RSA-OAEP key transport over PKCS#1 v1.5.

    • Constructor Detail

      • BcRSAAsymmetricKeyUnwrapper

        public BcRSAAsymmetricKeyUnwrapper​(org.bouncycastle.asn1.x509.AlgorithmIdentifier encAlgId,
                                   org.bouncycastle.crypto.params.AsymmetricKeyParameter privateKey)

    • Method Detail

      • createAsymmetricUnwrapper

        protected org.bouncycastle.crypto.AsymmetricBlockCipher createAsymmetricUnwrapper​(org.bouncycastle.asn1.ASN1ObjectIdentifier algorithm)
        Specified by:
        createAsymmetricUnwrapper in class BcAsymmetricKeyUnwrapper