Suppose I send a message using AES (private keys already negotiated securely) and I send a hash of this message using RSA (encrypted with private key) with OAEP to verify the authenticity and integrity of the message.

I can decrypt the hash with the public key (authentication) and compare the decrypted hash with a hash I generate from the message (integrity).

Why is it wrong to use OAEP for padding?

  • $\begingroup$ In addition to issues related to RSA, what your first paragraph describes is analogous to encrypt-and-MAC. $\endgroup$
    – user991
    Apr 12, 2014 at 18:12
  • $\begingroup$ "... using RSA (encrypted with private key)" - this is wrong terminology, and quite unclear. RSA can refer to either the RSA encryption scheme or the RSA signature scheme. And in any encryption scheme, the public key is used to encrypt and the private key is used to decrypt. In a signature scheme the signing key is used to sign and the verification key is used to verify. If you look just at the basic scheme for both, the private key and the signing key are related, and the public key and the verification key are related $\endgroup$
    – tylo
    Apr 14, 2014 at 14:05
  • $\begingroup$ Related: crypto.stackexchange.com/questions/15997/… $\endgroup$
    – Maarten Bodewes
    May 14, 2014 at 21:58

1 Answer 1


RSA-OAEP is an encryption scheme that is CCA secure in the random oracle model (http://en.wikipedia.org/wiki/Optimal_asymmetric_encryption_padding).

You are talking about encrypting/decrypting hashes with some private/public key, but I don't think you're actually talking about encryption schemes. What you probably mean are digital signature schemes (http://en.wikipedia.org/wiki/Digital_signature). RSA-PSS is not an encryption, but a signature scheme and therefore you use that to sign the message. Signatures and encryptions have different security requirements.

Since you are using a private key encryption scheme it seems that the authenticity of your communication partner might already be ensured (since you already established a common private key). In this case a message authentication code (http://en.wikipedia.org/wiki/Message_authentication_code), which provides integrity guarantees could be sufficient for you.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.