【摘要】 基于JSON的RSA-PKCS#1加密算法作为JSON的加密标准中首选的公钥加密算法,由于其要求明文在被加密前使用特定的填充规则对明文进行预处理操作,导致可被攻击者利用的选择密文攻击漏洞的产生,使得攻击者可以在未掌握RSA私钥的情况下破解密文。为此,本文从安全性角度分析基于JSON的RSA-PKCS#1加密算法以及选择密文攻击漏洞产生的成因,并根据分析结果构造攻击实验以证明其安全漏洞的存在,同时针对此漏洞提出基于固定值填充的加固方案,消除选择密文攻击的利用点,以提升加密算法的安全性。更多还原

【Abstract】 The RSA-PKCS#1 encryption algorithm in JSON is the first-choice encryption algorithm of the JSON encryption standard. But a chosen ciphertext attack against the algorithm is found because of bad padding process upon the plaintext before encrypted. Through this attack,attackers can crack the ciphertext without knowing the RSA private key. Therefore,this paper analyzes the security of the RSA-PKCS#1 encryption algorithm in JSON and the cause of the chosen ciphertext attack vulnerability. According to the analysis results,an attack experiment is constructed to prove the existence of the security vulnerability. At the same time,a strengthening scheme is proposed to avoid this vulnerability by returning fixed value instead of the plaintext.更多还原