ALG_RSA_NOPAD Illegal Use Exception despite message in proper alignment in Java Card

Question

I am trying to use an RSA private key to "encrypt" a message (I am trying to use the RSA encrypt operation for the use of the raw modulus exponential operation similar to the Diffie-Hellman) using the ALG_RSA_NOPAD algorithm in a JavaCard environment. I am getting the ILLEGAL_USE Exception despite ensuring my hard-coded message is zero filled by hard-coding as shown in the code below.

private byte[] M = {
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, //25
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, // 50
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, // 75
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, // 100
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, // 125
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, // 150
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, // 175
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, // 200
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, // 225
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, // 250
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00,
        (byte) 0x02 // 256
};
priv = (RSAPrivateKey) KeyBuilder.buildKey(KeyBuilder.TYPE_RSA_PRIVATE_TRANSIENT_RESET, KeyBuilder.LENGTH_RSA_2048, false);
cipher = Cipher.getInstance(Cipher.ALG_RSA_NOPAD, false);
KeyPair keyPair = new KeyPair(KeyPair.ALG_RSA, (short) priv.getSize());
keyPair.genKeyPair();
priv = (RSAPrivateKey) keyPair.getPrivate();
cipher.init(priv, Cipher.MODE_ENCRYPT);
cipher.doFinal(M, (short) 0, (short) 256, buff, (short) 0); // Encrypt hard-coded message M

What am I missing ?

By changing the ENCRYPT to DECRYPT mode, it works. Apparently there seems to be mechanism preventing PrivateKeys using ENRYPT mode. — thotheolh
– thotheolh, Commented Feb 21, 2016 at 13:21
Quote JavaCard 2.2.2 Cipher class "The asymmetric key algorithms encrypt using either a public key (to cipher) or a private key (to sign). In addition they decrypt using the either a private key (to decipher) or a public key (to verify).". It sounds rather ambiguous ? — thotheolh
– thotheolh, Commented Feb 22, 2016 at 10:40
@Abraham The encryption routine may not implement protection against side channel attacks to protect the key; it expects a public key anyway so why should it. Note that RSA on smart cards is often used with CRT parameters. CRT parameters are however specific to the private key, not the public key, so you may actually need more code. Furthermore, encryption with a private key doesn't provide any confidentiality, so it is actually a good thing to block this kind of operation. — Maarten Bodewes
– Maarten Bodewes, Commented Feb 22, 2016 at 13:36
@thotheolh Yeah, that "to sign" part would be for textbook RSA, which is incredibly insecure. Creating your own padding scheme may be vulnerable against side channel attacks and is therefore probably also not a good idea. So you should be careful what you do even if you can get this thing to work. — Maarten Bodewes
– Maarten Bodewes, Commented Feb 22, 2016 at 13:38

thotheolh · Accepted Answer · 2016-02-22 01:13:28Z

3

PrivateKey classes are not able to use ENCRYPT mode which the use of DECRYPT mode is the only option to get the RSA modulus exponential mechanism to work with a PrivateKey.

answered Feb 22, 2016 at 1:13

thotheolh

7,5907 gold badges36 silver badges50 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Maarten Bodewes Over a year ago

Note that the exception may be specific to a Java Card implementation.

Collectives™ on Stack Overflow

ALG_RSA_NOPAD Illegal Use Exception despite message in proper alignment in Java Card

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related