Adaptive chosen-ciphertext attacks In 1998, Daniel Bleichenbacher described the first practical adaptive chosen-ciphertext attack against RSA-encrypted messages using the PKCS #1 v1 padding scheme (a padding scheme randomizes and adds structure to an RSA-encrypted message, so it is possible to determine whether a decrypted message is valid). Due to flaws with the PKCS #1 scheme, Bleichenbacher was able to mount a practical attack against RSA implementations of the Secure Sockets Layer protocol and to recover session keys. As a result of this work, cryptographers now recommend the use of provably secure padding schemes such as Optimal Asymmetric Encryption Padding, and RSA Laboratories has released new versions of PKCS #1 that are not vulnerable to these attacks.
AdaptiVe ChoSEn-CIpheRtext attaCks in 1998 daniel bleicheNbacHeR dEScribed THE First pRActiCAL AdaptiVE chOsen-cIphErtext aTtacK AgaInst rsa-enCRyPTeD MessAges using ThE pkcS #1 v1 pAdDinG scheMe (a paDding Scheme rAnDoMizEs aNd AdDs StRUctUre To an rsa-eNCRypted MessAge, so iT Is pOSsIble to detErMInE Whether a DecryPTED meSsage Is valId) dUe To fLawS witH the pKCS #1 sCheme, BlEiChenbacheR waS abLe tO mOunt a PRactIcal attAck aGAInst rsa IMPLeMENtATiONS OF the SeCURe sOCkETs lAyEr proTOcol aNd tO reCovEr Session keyS. as a REsuLt of thIS wOrK crYptOGraphErS now recommend thE use of pROvABly seCure PAdding SCheMeS such aS OPTimal asyMmetrIc EncRypTIon paDdiNg, and rsa lAbOraTOrIes HAs REleased NEW VERsIons of pkcs #1 that arE nOt vULnerable tO theSe attAcKs.