New answers tagged padding-oracle
Yes, and it's devastatingly effective, too. See OAEP and other RSA/asymmetric-function padding standards. OAEP is what you should use these days so far as I am aware. PKCS#1 has other defined padding schemes also (eg PSS, PKCS1.5), only some of which are effective.
You can use the RSA key encapsulation to establish a random symmetric key. Then (in the same protocol message) use this key to protect the data payload (i.e. using some AE/AEAD mode you mentioned). The RSA key encapsulation should be Padding Oracle Attack resistant (as it does not use any padding). Another advantage is that your payload length is not ...
With pure asymmetric encryption there is no way to ensure integrity and authenticity, since anyone who knows your public key can encrypt any message for you. For that you would need either a symmetric key to use for a MAC (in which case you could use it/derivatives for symmetric encryption too) or a signature from the sender. And in the latter case the ...
Top 50 recent answers are included