Modulecrypton-2.1.7Haskell2010

Crypto.PubKey.Rabin.OAEP

OAEP padding scheme. See http://en.wikipedia.org/wiki/Optimal_asymmetric_encryption_padding.

1 type
3 values

Packagecrypton-2.1.7
Exports4
LanguageHaskell2010
LicenceBSD-3-Clause AND MIT AND ISC
SourceOAEP.hs

datadata OAEPParams hash seed output

Parameters for OAEP padding.

Constructors

OAEPParams
- oaepHash :: hash
  hash function to use
- oaepMaskGenAlg :: MaskGenAlgorithm seed output
  mask Gen algorithm to use
- oaepLabel :: Maybe ByteString
  optional label prepended to message

valuedefaultOAEPParams

:: (ByteArrayAccess seed, ByteArray output, HashAlgorithm hash)
=> hash
-> OAEPParams hash seed output

Default Params with a specified hash function.

valuepad

:: HashAlgorithm hash
=> ByteString
Seed
-> OAEPParams hash ByteString ByteString
OAEP params to use
-> Int
size of public key in bytes
-> ByteString
Message pad
-> Either Error ByteString

Pad a message using OAEP.

valueunpad

:: HashAlgorithm hash
=> OAEPParams hash ByteString ByteString
OAEP params to use
-> Int
size of public key in bytes
-> ByteString
encoded message (not encrypted)
-> Either Error ByteString

Un-pad a OAEP encoded message.

The data block is scanned in full rather than up to the 01 octet separating the padding from the message, and the label hash and the leading octet are compared without an early exit, so neither the length of the padding nor where a comparison first differs shows up in how long this takes. This is what Crypto.PubKey.RSA.OAEP does with the same block.

What remains visible is the result itself: whether the block was well formed, and the length of the message when it was. That is the signal Manger's attack needs, so a caller that decrypts attacker-supplied ciphertext must not pass the distinction on.