I recently came across the following in some notes from a cryptography
lecture. I wonder if it has been properly dealt with in the PEM procedures?
Yes, this attack was known about. It was one of the reasons for using
2^16 + 1 instead of 3 as the recommended exponent in X.509. (Although X.509
is somewhat reticent about the reasons for the choice!)
PEM part II references X.509 for certificate-based key management and hence
implementors who follow up the references will come across this recommendation.
Now that you mention it, I agree that it probably should be given greater
prominence in the PEM RFCs themselves (probably part III).
Michael Roe
Cambridge University Computer Lab