On the importance of securing your bins : The garbage - man - in - the - middle attackMarc

In this paper, we address the following problem: \ Is it possible to weaken/attack a scheme when a (provably) secure cryptosystem is used? ". The answer is yes. We exploit weak error-handling methods. Our attack relies on the cryptana-lyst being able to modify some ciphertext and then getting access to the decryption of this modiied ciphertext. and Re-iter 4] presented a serious weakness in the basic protocol for encrypting related messages using the RSA public-key cryptosystem 24] with low exponent. Therefore, if an authority uses a RSA-based protocol to distribute secret keys among a group of users, a cryptanalyst can recover the secret keys of the users which have a relatively small public encryption key (typically less than 32 bits). Suppose that Alice has a small public encryption key and that the authority wants to send her the secret key kA, then the cryptanalyst does the following. He intercepts the ciphertext corresponding to kA. So, since Alice does not receive the ciphertext, she asks the authority to re-send it. If the system is not well designed (for example, if the time or an ID number is included before the encryption), then the cryptanalyst applies the attack of Coppersmith et al. to recover the secret key from the two corresponding ciphertexts (the intercepted one and its retransmission). Moreover, even if the authority is more malicious and chooses a clever protocol in order to prevent the previous attack , we will show that a cryptanalyst will be able to recover all the secrets keys, and not only the ones encrypted with a small exponent. Last but not least, our attack is of very general nature. It applies on many public-key cryptosystems,