Security advisory - RSA signatures with 3 as a public exponent and the BC provider

Hi all,

A researcher by the name of Daniel Bleichenbacher recently disclosed an
attack on RSA signatures using PKCS-1 v1.5 padding with the public key
having the exponent of 3.

I won't go into the details of the attack here but you can find details
in a number of places including:

http://www.matasano.com/log/469/many-rsa-signatures-may-be-forgeable-in-openssl-and-elsewhere/

The BC provider is vulnerable to some versions of this attack, and we
believe the latest beta fixes the problem.

If you are using RSA signatures with a public exponent of 3 we strongly
recommend you download the beta from http://www.bouncycastle.org/betas
and start using it. If you have any comments on the current
implementation and how it deals with this attack (see
org.bouncycastle.jce.provider.JDKDigestSignature and
org.bouncycastle.crypto.encodings.PKCS1Encoding for the classes
involved) please let me know.

Subject to comments we'll be trying to get 1.34 out in the next week or
so.

Many thanks to the people have helped with evaluation and suggestions so
far - you know who you are!

Regards,

David