Tag Info

New answers tagged


After some thought, I think the answer is in fact NO, even for CCA1 and even for Shoup's OAEP+. RSA-OAEP/OAEP+ work by taking a message $m$, producing a padding $p(m,r)$ and then encrypting this, so $c = f(p(m,r))$ where $f$ is RSA encryption, and $f(u) = u^e \pmod{N}$ is deterministic. In fact, the whole point of OAEP(+) is to inject some entropy into ...

Top 50 recent answers are included