RSACryptoServiceProviderEncrypt without padding is not possible

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

Eugen - 15 Dec 2005 13:51 GMT

Hi,

I can't believe this, now I have to write the whole RSA library by
myself, just because someone at Mircosoft thinks, it is unsecure, to do
my own padding.

Why? Take a look at HBCI, the german standard für banking transactions.
The RDH specification requires a padding of the session key with plain
binary 0 values. I do not care if this is secure or not or whatever. It
is the standard in germany. Period.

And now, I have to sit down write my own implementation of the RSA
stuff.

Nice christmas present, thanks a lot. I thought I would be bored...

Reply to this Message

Pieter Philippaerts - 03 Jan 2006 16:16 GMT

"Eugen" <eugen1@fastfertig.net> wrote in message

> I can't believe this, now I have to write the whole RSA library by myself,
> just because someone at Mircosoft thinks, it is unsecure, to do my own
[quoted text clipped - 3 lines]
> binary 0 values. I do not care if this is secure or not or whatever. It is
> the standard in germany. Period.

Actually, starting with .NET 1.0, Microsoft decided to
support -architectually at least- the implemantation of custom padding
schemes. That's why they created the formatter/deformatter classes from
which you can inherit and implement your own padding scheme.
And yes, I know that the RSACryptoServiceProvider class doesn't support the
EncryptValue/DecryptValue methods that are necessary for your code to work,
but that's because of historical reasons (.NET uses the CryptoAPI
underneath), not because someone at Microsoft tried to ruin your Christmas.

Anyhow, all you need to do is drop in a replacement for the
RSACryptoServiceProvider, for instance the one from the mono project. If you
are unsure on how to do this, take a look at this page:
http://lab.msdn.microsoft.com/productfeedback/viewfeedback.aspx?feedbackid=77ce5
cfe-7a78-40c2-9f82-bf2df2f1d548
The bug report contains a download project that uses the RSAManaged class
from mono.

Regards,
Pieter Philippaerts

Reply to this Message

RSACryptoServiceProviderEncrypt without padding is not possible

Free Magazines