#2 is often done incorrectly even by experienced users. After a padding error, it's really hard to keep going forward long enough without returning an early error.
How is this relevant in the context of setting up a connection protected by DH and RSA? Yes, it would be a problem any time you decrypt RSA. So pgp is tricky, but setting up a ssh or tls connection without DH is beyond foolish. For signature verification, there is no way that an adversary can gain anything by inserting a padding violation.
Assuming properly authenticated data, then decrypting without checking padding is no problem. For RSA encryption, padding only protects the sender. By itself RSA encryted data cannot be trusted, you need separate integrity protection for that.
Obviously. But for checking the padding on a signature you only need the public key. So you cannot leak any sensitive RSA key material while checking the padding.
Comments
#2 is often done incorrectly even by experienced users. After a padding error, it's really hard to keep going forward long enough without returning an early error.
How is this relevant in the context of setting up a connection protected by DH and RSA? Yes, it would be a problem any time you decrypt RSA. So pgp is tricky, but setting up a ssh or tls connection without DH is beyond foolish. For signature verification, there is no way that an adversary can gain anything by inserting a padding violation.
Assuming properly authenticated data, then decrypting without checking padding is no problem. For RSA encryption, padding only protects the sender. By itself RSA encryted data cannot be trusted, you need separate integrity protection for that.
There are attacks against RSA signatures when padding is omittted.
Obviously. But for checking the padding on a signature you only need the public key. So you cannot leak any sensitive RSA key material while checking the padding.
Padding attacks don't leak key material; they leak plaintext.
Right an attack on an RSA signature that leaks plain text. Really? Must be a super secret signature then.
You should familiarize yourself with how RSA works, and what an RSA signature is.
Well in this case they potentially allow forgeries, but yes.