Connect2id: Timing attack in Nimbus-Jose

Summary

Nimbus-Jose allows a chosen message attack that can decrypt RSA encrypted ciphertexts by measuring the decryption time. The attack uses the timing difference caused by an internal exception and allows to distinguish ciphertexts with valid PKCS #1 v1.5 paddings from ciphertexts with invalid paddings.

Severity

Moderate - This could allow the attacker to choose the messages that are encrypted and decrypted by a cryptographic system. This allows the attacker to learn more about the system and how it works, which can then be used to launch more sophisticated attacks.

Proof of Concept

https://github.com/google/wycheproof/commit/b063b4aedae951c69df014cd25fa6d69ae9e8cb9

Timeline

Date reported: 3/03/2023

Date fixed:

Date disclosed: 06/05/2023