This paper introduces a new adaptive chosen ciphertext attack against certain protocols based on RSA. We show that an RSA
private-key operation can be performed if the attacker has access to an oracle that, for any chosen ciphertext, returns only
one bit telling whether the ciphertext corresponds to some unknown block of data encrypted using PKCS #1. An example of a
protocol susceptible to our attack is SSL V.3.0.
Keywords chosen ciphertext attack - RSA - PKCS - SSL