Add a ref to a paper describing a chosen ciphertext attack on OAEP

since it is relevant to the implementation.

1 files changed, 8 insertions, 0 deletions

diff --git a/src/pk_pad/eme1/eme1.cpp b/src/pk_pad/eme1/eme1.cpp
index b5f2af6d3..e5db17df6 100644
--- a/src/pk_pad/eme1/eme1.cpp
+++ b/src/pk_pad/eme1/eme1.cpp
@@ -42,6 +42,14 @@ SecureVector<byte> EME1::pad(const byte in[], u32bit in_length,
 SecureVector<byte> EME1::unpad(const byte in[], u32bit in_length,
                                u32bit key_length) const
    {
+   /*
+   Must be careful about error messages here; if an attacker can
+   distinguish them, it is easy to use the differences as an oracle to
+   find the secret key, as described in "A Chosen Ciphertext Attack on
+   RSA Optimal Asymmetric Encryption Padding (OAEP) as Standardized in
+   PKCS #1 v2.0", James Manger, Crypto 2001
+   */
+
    key_length /= 8;
    if(in_length > key_length)
       throw Decoding_Error("Invalid EME1 encoding");