Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Using RSA public key (n,e) the encryption of a message is

c= (m^e) mod n

and the corresponding message is decrypted as

m = (c^d) mod n

How does the RSAES-OAEP algorithm specified in PKSC#1 v2.1 differ from the above basic method?

Is it possible to decrypt a text encrypted using RSA PCKS1 v2.1 RSAES-OAEP algorithm with Raw rsa decryption method (ie, m = (c^d) mod n ) ?

share|improve this question

Directly applying the RSA-function to a message is not secure in real life. The function leaks all kinds of information about the underlying plaintext and is particularly vulnerable to active attacks (where the attacker might be able to learn something about some related message also encrypted under RSA, and use this to learn what the original message was). Unfortunately, some textbooks only present RSA as you have done above and leaves it at that, hence the term textbook-RSA is often used for this raw application of the RSA-function to the message.

However, the good news is that if your message was somehow chosen completely at random within $\mathbb{Z}_n$ (the full plaintext space), then applying the RSA-function would actually be secure. Unfortunately in real life, our messages are seldom completely random, but rather chosen from a very tiny subset within $\mathbb{Z}_n$. The solution is to randomize the message using padding so that our messages takes up a much larger possible subset within the plaintext space. Additionally we make it so that equal messages encrypts to different ciphertexts each time, which is important. In real life we use RSA like this:

Encrypt: $m \rightarrow$ randomize message using some padding scheme $\rightarrow x$ $\rightarrow c = x^e \pmod n$

Decrypt: $x = c^d \pmod n \rightarrow$ check whether padding is how it should be $\rightarrow$ if yes: strip of padding from $x$ and return $m$; if no: return Fail.

The question then becomes: how should we pad the message $m$? OAEP is one such padding scheme (there are actually many ways how this can be done, but not all of them are secure. RSA-OAEP fortunately is). So how does OAEP-work? You should check out the description on Wikipedia, but this picture goes a long way of explaining it:

$\hskip 2 in$

After the message you pad with some zero's then append a completely random string $r$. Then feed these through a couple of hash functions $G$ and $H$ and some XOR-applications and output the padded message $x \| y$. Then you encrypt this padded output. When you decrypt you basically reverse the whole process and verify that you have the right number of zeroes at the end (before the $r$).

share|improve this answer

It is actually the same method, the OAEP part simply defines how the plaintext is padded prior to encryption.

share|improve this answer
In open SSL, if padding RSA_PKCS1_OAEP_PADDING is used, it used PKCS#1 v2.1 RSAES scheme with SHA1 as hash function and MGF1 as mask generating function. Why are we using these hash function and mask generation function ? – jithin Sep 3 '13 at 9:40
@jithin Hint: that's actually another question you're asking. ;) – e-sushi Sep 3 '13 at 14:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.