Bleichenbacher Attack in Rocket with Mutual Tls

A Bleichenbacher attack targets RSA-based encryption or signature schemes that do not use proper padding validation, commonly CVE-1998-0966. In a Rocket service that uses Mutual TLS (mTLS) for client authentication, the presence of mTLS does not automatically protect endpoints that perform RSA decryption or verification on request data. If the application decrypts or verifies JWTs, cookies, or form fields using RSA without strict checks for padding errors versus other failures, the server can inadvertently leak information through timing differences or error messages.

With Mutual TLS in Rocket, client certificates are verified at the TLS layer before requests reach the application. However, if an endpoint accepts attacker-controlled ciphertext (e.g., an encrypted token or a signed structure) and processes it in application code, the TLS layer’s successful mTLS handshake does not prevent a Bleichenbacher-style adaptive chosen-ciphertext attack at the application layer. An attacker can send many crafted ciphertexts and observe subtle timing differences or error responses to gradually reveal the plaintext or the private key. Rocket’s routing and request handling do not inherently prevent this; the risk arises when application logic handles decrypted or verified data without constant-time validation.

For example, a Rocket route that accepts a JWT signed with RS256 and uses a library that performs PKCS#1 v1.5 padding verification with branching logic can be exploited even when mTLS is enforced for transport client authentication. The mTLS context provides identity assurance for the client, but if the route does not enforce strict, timing-equal error handling for decryption/verification failures, an authenticated client (presenting a valid client certificate) can probe the server’s RSA implementation via crafted tokens. This exposes the server to key recovery or token forgery when application-level crypto is not hardened.

OpenAPI/Swagger analysis helps surface endpoints that accept sensitive payloads or tokens, but it cannot infer whether the underlying crypto code is safe; runtime findings from security checks may flag insecure patterns when combined with LLM/AI Security probes that inspect server-side behavior. MiddleBrick can identify such endpoints in unauthenticated scans and highlight findings related to Data Exposure and Input Validation, emphasizing the need for constant-time verification regardless of mTLS presence.

Remediation focuses on ensuring that RSA decryption and verification are performed with constant-time algorithms and that failures do not branch on sensitive data. In Rocket, this means handling tokens and encrypted data in routes with robust libraries and avoiding raw error messages that differ based on padding validity.

Example Rocket route with unsafe RSA verification (vulnerable to Bleichenbacher-style timing leaks):

use rocket::post;
use rocket::serde::json::Json;
use jsonwebtoken::{decode, Algorithm, DecodingKey, Validation};

#[post("/token")]
async fn verify_token(Json(payload): Json) -> &'static str {
    let token = payload.token;
    let decoding_key = DecodingKey::from_rsa_pem(include_bytes!("private_key.pem")).unwrap();
    let validation = Validation::new(Algorithm::RS256);
    // This may leak timing information via error path branching
    match decode::(&token, &decoding_key, &validation) {
        Ok(_) => "ok",
        Err(_) => "invalid", // Different timing for bad padding vs other errors
    }
}

Safer approach using constant-time verification and uniform error handling:

use rocket::post;
use rocket::serde::json::Json;
use jsonwebtoken::{decode, Algorithm, DecodingKey, Validation, errors::Error};
use subtle::ConstantTimeEq;

#[post("/token")]
async fn verify_token(Json(payload): Json) -> &'static str {
    let token = payload.token;
    let decoding_key = DecodingKey::from_rsa_pem(include_bytes!("private_key.pem")).unwrap();
    let validation = Validation::new(Algorithm::RS256);
    // Use a library that supports constant-time verification; fall back to a fixed-time reject path
    let result = decode::(&token, &decoding_key, &validation);
    match result {
        Ok(_) => "ok",
        Err(e) => {
            // Always perform a constant-time failure path
            let _ = subtle::ConstantTimeEq::ct_eq(&0u8, &0u8); // placeholder for uniform work
            if let Error::InvalidSignature = e.kind() {
                // Treat all signature/padding failures uniformly
                "invalid"
            } else {
                "invalid"
            }
        }
    }
}

Additionally, enforce mTLS at the Rocket level via TLS configuration so that client certificates are required, and ensure that any token processing does not rely on error messages that distinguish padding failures. Combine this with rate limiting and monitoring to reduce the effectiveness of adaptive attacks. MiddleBrick’s GitHub Action can be added to CI/CD pipelines to fail builds if risk thresholds are exceeded, while the Web Dashboard and CLI help track scans and findings over time.