Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If an adversary knows my public key and guesses what was my plaintext, can he test for it somehow?

The most obvious way is encrypting the guessed plaintext with my public key and the same parameters that he can probably discover from the ciphertext, to see if the result is the same.

share|improve this question
Would randomized padding have been used? $\:$ – Ricky Demer Apr 28 '13 at 6:12
It is optional?! Isn't it the default when using crypto libraries? – H M Apr 28 '13 at 6:14
No, ..., which is why I found the last part of your post strange. $\:$ – Ricky Demer Apr 28 '13 at 6:18
@Ricky Demer, I think it is considered an important weakness in a cipher that an adversary can discover such thing from the ciphertext, so I guessed it should be somehow prevented by default (but i were not sure so I posted a question about it). – H M Apr 28 '13 at 6:34
I would certainly hope so. $\:$ – Ricky Demer Apr 28 '13 at 7:21
up vote 1 down vote accepted

The answer to your question is "yes, RSA will encrypt the same cleartext to the same ciphertext every time." And yes, this is a known property of RSA. That's why every standard that uses RSA, such as PKCS or CMS, specifies the use of randomized padding.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.