Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
Suppose I send a message using AES (private keys already negotiated securely) and I send a hash of this message using RSA (encrypted with private key) with OAEP to verify the authenticity and integrity of the message.
I can decrypt the hash with the public key (authentication) and compare the decrypted hash with a hash I generate from the message (integrity).
Why is it wrong to use OAEP for padding?
RSA-OAEP is an encryption scheme that is CCA secure in the random oracle model (http://en.wikipedia.org/wiki/Optimal_asymmetric_encryption_padding).
You are talking about encrypting/decrypting hashes with some private/public key, but I don't think you're actually talking about encryption schemes. What you probably mean are digital signature schemes (http://en.wikipedia.org/wiki/Digital_signature). RSA-PSS is not an encryption, but a signature scheme and therefore you use that to sign the message. Signatures and encryptions have different security requirements.
Since you are using a private key encryption scheme it seems that the authenticity of your communication partner might already be ensured (since you already established a common private key). In this case a message authentication code (http://en.wikipedia.org/wiki/Message_authentication_code), which provides integrity guarantees could be sufficient for you.
