Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

how OpenSSL RSA work ?

I generate public (n,e) and private key (n,d) then I encypted a file by :

openssl rsautl -encrypt -in plaintextFile -inkey privkey.pem -out cipher00

let's note the result C

and I tried to decrypt it by doing C^d (modulo n) but it doesn't work.

I think this is because OpenSSL adds some random value to my plaintext before the encryption. If I run the previous command once again on the same plaintext I have a different ciphertext.

How can I remove this random during the decryption?

share|improve this question
In general, identical plaintext should result in a different ciphertext. Otherwise you leak information to an attacker. If the attacker can guess what a specific ciphertext means he knows that a repetition of the ciphertext means the same thing. This goes for symmetric ciphers (the use of an IV or nonce) as well as asymmetric ones (random padding). – Maarten Bodewes Nov 16 '14 at 20:22

The "normal", unmodified RSA (called textbook RSA) is susceptible to some attacks. We need to change it slightly to avoid this problems. The question Definition of Textbook RSA and the Wikipedia lists some possible attacks. In practice a special padding algorithm is used, like the Optimal asymmetric encryption padding (OAEP). The documentation of the RSA_public_encrypt function in OpenSSL shows the possible padding algorithm which can be used.

So yes, OpenSSL adds some random information to the plaintext. Without this, RSA would be deterministic: The same ciphertext would reveal that the plaintext was also identical. If you want to decrypt the ciphertext, then you have to either use OpenSSL again, or remove the padding manually.

share|improve this answer
More to the point, doc for the rsautl command tells you it supports OAEP but defaults to PKCS#1v1.5, which is randomized but in a fashion easier to remove than OAEP. – dave_thompson_085 Feb 8 at 18:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.