The actual vulnerability (a padding oracle attack against RSA encryption that uses PKCS1v1.5 padding) was originally published in 1998 by Daniel Bleichenbacher. This padding oracle vulnerability allows an attacker to take an encrypted message, and repeatedly send altered ciphertexts to the server (each time looking for some indication of a padding error), and consequently decrypt the original message.

[...]

Sadly, when we look at PHP software (both open source and proprietary), we still uncover application-layer cryptography protocols written in 2016 that are vulnerable to this attack (and others we'll cover below).

[...]

In PHP, most RSA implementations will make use of two functions to actually encrypt/decrypt data:

• openssl_public_encrypt()
• openssl_private_decrypt()

Look at both function prototypes. There's an insecure default value here.

The constant OPENSSL_PKCS1_PADDING tells the OpenSSL extension, "We want to use PKCS1 v1.5 padding." But, as we said before, it has been public knowledge that RSA encryption that uses PKCS1 v1.5 padding is vulnerable to a padding oracle vulnerability since 1998. This attack is more generally known as the "million message attack" due to the attack cost requiring a million messages to recover a plaintext.

The solution is to specify OPENSSL_PKCS1_OAEP_PADDING whenever you use either function. This constant forces the use of OAEP padding instead of insecure PKCS1 v1.5 padding.

[...]

If you read the previous section and thought, "Okay, if I just remember to use OAEP, I'm in the clear to directly encrypt arbitrary messages with RSA," not so fast. You actually cannot encrypt large messages with RSA directly (proof-of-concept code).

When confronted with this limitation, most developers try to be clever: They'll just break the message into 214-byte chunks (for 2048-bit keys) and encrypt each block independently. As a shorthand, we refer to this as RSA in ECB mode.

Aside from the obvious attack (you can duplicate, reorder, or delete 214-byte blocks at will without creating a decryption error) and the fun you can have with known-plaintext attacks, RSA is slow. Criminals are more likely to just abuse this feature for DDoS amplification (to great effect) than to pursue any cryptanalysis efforts.

The best way to implement public key encryption is to build a hybrid cryptosystem, which combines symmetric-key and and asymmetric-key cryptography algorithms. [...]

Via https://twitter.com/bearstech/status/813819230630068224 via https://twitter.com/bluetouff