Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Suppose I send a message using AES (private keys already negotiated securely) and I send a hash of this message using RSA (encrypted with private key) with OAEP to verify the authenticity and integrity of the message.

I can decrypt the hash with the public key (authentication) and compare the decrypted hash with a hash I generate from the message (integrity).

Why is it wrong to use OAEP for padding?

share|improve this question
    
In addition to issues related to RSA, what your first paragraph describes is analogous to encrypt-and-MAC. –  Ricky Demer Apr 12 at 18:12
    
"... using RSA (encrypted with private key)" - this is wrong terminology, and quite unclear. RSA can refer to either the RSA encryption scheme or the RSA signature scheme. And in any encryption scheme, the public key is used to encrypt and the private key is used to decrypt. In a signature scheme the signing key is used to sign and the verification key is used to verify. If you look just at the basic scheme for both, the private key and the signing key are related, and the public key and the verification key are related –  tylo Apr 14 at 14:05
    

1 Answer 1

RSA-OAEP is an encryption scheme that is CCA secure in the random oracle model (http://en.wikipedia.org/wiki/Optimal_asymmetric_encryption_padding).

You are talking about encrypting/decrypting hashes with some private/public key, but I don't think you're actually talking about encryption schemes. What you probably mean are digital signature schemes (http://en.wikipedia.org/wiki/Digital_signature). RSA-PSS is not an encryption, but a signature scheme and therefore you use that to sign the message. Signatures and encryptions have different security requirements.

Since you are using a private key encryption scheme it seems that the authenticity of your communication partner might already be ensured (since you already established a common private key). In this case a message authentication code (http://en.wikipedia.org/wiki/Message_authentication_code), which provides integrity guarantees could be sufficient for you.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.