JSON Web Encryption (RFC7516) specifies tokens encrypted with RSAES-PKCS1-v1_5 padding using RSA1_5.
Based on recent results in the Marvin Attack, it's highly unlikely that any API that accepts RSAES-PKCS1-v1_5 encrypted ciphertexts is actually safe against timing variants of the Bleichenbacher attack.
As such, acceptance of such ciphertexts should be recognised as a vulnerability. Use of this algorithm for backwards compatibility is invalid, as the WebCrypto JavaScript API provided by all currently supported browsers supports only OAEP padding (alg id of RSA-OAEP).
Implementations of XMLEnc are also likely vulnerable, but I don't know if it's similarly standardised for use in web APIs as JWE is.
JSON Web Encryption (RFC7516) specifies tokens encrypted with RSAES-PKCS1-v1_5 padding using
RSA1_5.Based on recent results in the Marvin Attack, it's highly unlikely that any API that accepts RSAES-PKCS1-v1_5 encrypted ciphertexts is actually safe against timing variants of the Bleichenbacher attack.
As such, acceptance of such ciphertexts should be recognised as a vulnerability. Use of this algorithm for backwards compatibility is invalid, as the WebCrypto JavaScript API provided by all currently supported browsers supports only OAEP padding (alg id of
RSA-OAEP).Implementations of XMLEnc are also likely vulnerable, but I don't know if it's similarly standardised for use in web APIs as JWE is.