RSA encryption secure mode, plaintext length limit vs. key length

Question

I have two questions about RSA encryption to confirm:

1. Assume use RSA 2048-bit key pair, what is the secure encryption mode? Are ECB / OAEPWithSHA-256AndMGF1Padding and ECB / OAEPWithSHA-1AndMGF1Padding secure modes?

2. For example, we know the maximim length of plaintext to be encrypted is limited by key length.

RSA was not designed to work with large amount of data. You can process messages only with limited length, that depends on the key size. The bigger key is, the bigger message can be encrypted.

For 2048 key, what is the maximum plaintext length? What is the math relation between them?

Answer 1

Lets assume Java here. In that case the ECB part of the name is a misnomer. ECB is the most simple mode for a block cipher. It means splitting up the plaintext message into multipe blocks and then encrypting them separately. Java's RSA implementation doesn't split anything up, you can only encrypt a single block of plaintext. They should have used "None" instead or have left it out altogether.

Yes, OAEP is secure, if implemented correctly. It requires a mask generation function parameterized with a cryptographically secure hash function. You can compare MGF1 with a key derivation function. For that kind of usages SHA-1 is still secure. I'd still prefer SHA-256 none-the-less, if just to avoid nasty questions on the protocol. It is plenty fast for this kind of use and new processors even contain instructions to speed up the algorithm.

For the maximum plaintext message I'll simply refer to a previous answer. It lists a payload size of 214 bytes for SHA-1 and 190 bytes for SHA-256 if OAEP is used.