Design an API for safer RSA PKCS#1v1.5 decryption of session keys

[alex]

To protect against bleichbacher attackers. Probably modeled on https://golang.org/pkg/crypto/rsa/#DecryptPKCS1v15SessionKey

[tomato42]

Alternatively, something like RSA_padding_check_PKCS1_type_2 from OpenSSL https://github.com/openssl/openssl/blob/master/crypto/rsa/rsa_pk1.c#L170

[tomato42]

@alex how users will know that they need to contribute a safe implementation?

[alex]

We've tried to lay out clearly in the docs the contexts in which this is required. If you think there's room to improve the docs, we're happy to make changes.

[tomato42]

@alex yes, it's clear and it's arguably correct; the problem is that unless there's an unfixed CVE, dependents generally don't look into the state of libraries they depend on

so they will continue to use a known unsafe API without knowing that it is unsafe

[alex]

That was always going to be the case: You can't have a constant-time API that works the way our current API does, you need a dedicated API for the session key use case, like Go does. So users in these contexts were always going to need to take some specific action.

If there are libraries implementing, for example, TLS with RSA key exchange on top of cryptography, the correct thing is to obtain a CVE against them and then work with us to implement this API.

After research @reaperhulk and I decided that because RSA key exchange is so disfavored for a multitude of reasons, we were not inclined to invest in this unless there was a compelling and concrete use case.