RSA can't be used securely as is as it is deterministic. So an encrypted "yes" always looks the same. A simple workaround, which is apparently not secure, is to add 100 bits, say, of random salt to your plaintext before encryption. Why is this not considered secure?

  • $\begingroup$ Do you have a citation for that claim? $\endgroup$
    – Daniel S
    Commented Mar 7 at 10:06
  • $\begingroup$ To be honest you are almost 20 years late about this. The history is long about this and we have tons of questions on this. We have RSAES-PKCS1-v1_5 padding and RSAES-OAEP. former still problematic due to incorrect coding and later is proven to be secure. $\endgroup$
    – kelalaka
    Commented Mar 7 at 10:06
  • $\begingroup$ Duplicates : RSA signature with random padding Why don't use random padding in RSA? $\endgroup$
    – kelalaka
    Commented Mar 7 at 10:10
  • $\begingroup$ Sketch of an argument (different from that in answer to the slightly different second question linked in the above comment): even with $e=65537$ and a receiving end that does not leak anything about an attempted decryption (contrary to what happened so many times with error codes or timing variation), there's a sizable chance that the padded message is the product of two numbers both less than 64-bit, and then there is an attack with cost $2^{64}$ something that deciphers the cryptogram. $\endgroup$
    – fgrieu
    Commented Mar 7 at 10:50
  • $\begingroup$ @fgrieu-modelectiontime Oh that sounds interesting. Would you be able to flesh out the math for that please? $\endgroup$
    – Simd
    Commented Mar 7 at 11:03


Browse other questions tagged or ask your own question.