Consider the following scenario:
Sender S sends a message to receiver R. He uses a hybrid encryption scheme with RSA as key-encapsulation algorithm and AES-256-CTR (4byte-counter) and SHA256-HMAC. These algorithms are specified and already known by the receiver → the receiver knows the encrypted key length:
32byte AES-key + 12byte AES-nonce + 64byte HMAC-key = 108byte
Why don't use
RSA(SECURE_RANDOM(404) || key-block) as padding-scheme?
- The length is already known by the receiver, so there is no reason to indicate it.
- If the key-capsule is altered it will be detected because the decrypted keys will be wrong and the HMAC-verification will fail.
- It shouldn't be susceptible against padding-oracle-attacks because the application cannot distinguish between correct decryption and defect padding (in contrast to PKCSv1.5 and OAEP after standard).
There probably is a very good reason not to do this, but I'm not seeing it.