◄ Wiki / Crypto

PKCS#1 v1.5

An older standard way to pad data before RSA signs it, whose loose parsing has historically let attackers forge signatures.

RSA can't sign a raw message directly; the message hash must be wrapped in a specific padding structure first, and PKCS#1 v1.5 is a long-standing scheme for that wrapping. The danger is verification: if a checker parses the padding leniently instead of demanding an exact byte layout, an attacker can craft a fake structure that passes, forging a valid-looking signature. Correct implementations must parse it strictly to avoid this classic vulnerability.