signature with Bleichenbacher’s attack I understood Bleichenbacher &amp; ROBOTO attack, however I have some trouble understanding Section 3.5 of ROBOT attack which discusses retrieving private keys.
https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-bock.pdf


  In order to create a signature with the server’s private key, the
  attacker first uses a proper hash function and encoding to process the
  message. For example, when creating a PKCS #1 v1.5 signature for
  message M, the encoded result will have the following format [29]: 
  
  EM = 0x0001 || 0xFF...FF || 0x00 || ASN.1(hash(M))
  
  hash() denotes a cryptographic hash function.


What message M is the author talking about? Is this TLS session establishment?
Can someone shed more light on this section 3.5
What message M is the author talking about? Is this TLS session establishment? Can someone shed more light on this section 3.5


First of all, you need to understand what the Bleichenbacher attack is (by the description in your answer, you don't).

What it is is a way of, given a value $EM$, computing $EM^d \bmod N$, given an Oracle that will, given a value $EM'$, telling you whether $EM'^d \bmod N$ has value PKCS #1.5 encryption padding (which is different from the signature padding).  The attacker can often find an Oracle by using a protocol where he sends an encrypted value to the system under attack, and observing how the system reacts (whether he acts as if the decryption failed, or whether he acts like he got some valid value).

When the attack was first published 20 years ago, it would require a huge number (circa a million) different $EM'$ values to actually work; later refinements significantly reduced that number, to circa 10,000 messages IIRC.

Now, on to TLS and your actual question, and while the paper does look at protocols beyond TLS, I'll focus on TLS.

When the TLS server establishes a connection, it sends both its certificate (showing that it owns a public key), and something signed with that public key.  If the signature doesn't verify, the client rejects the connection.

So, in order to masquerade as the server, you'd need to do the same thing; you need to send a certificate (which this attack reuses the valid server's certificate), and then the signature of something; that something is the message M.

Now, if you look into the TLS protocol, this $M$ is the transcript of the TLS negotiation up to that point; the details aren't actually relevant to the attack, except that they aren't known until the negotiation actually happens (as it includes unpredictable values chosen by the client).

So, what the paper proposes we do is masquerade as the server up until the point where it actually has to generate the signature.  It knows $M$, and so we able to compute $EM$.  Then, by quickly performing the Bleichenbacher attack against the real server, it recovers $EM^d \bmod N$ before the client times out.  This $EM^d \bmod N$ value is the correct signature for $M$, and so the attacker can present that to the client, and the attack succeeds.