# IND-CCA1 RSA padding?

I've found a way to complete a task which I'd solve with passwords or by sending keys over the wire (otherwise) by using RSA's homomorphic property.

I'm restricted to RSA (any padding; for hardware reasons) to implement "blindable decryption", where one party holds some encrypted data, blinds it, sends it to the decryption oracle, receives it and recovers the embedded key by unblinding.

For this a "secure-as-possible" version of RSA is required which still has the multiplicative homomorphic property.

So what is the best padding for RSA that keeps this property?

Note: An IND-CCA1 version of RSA would be perfectly fine.
My definition of best (in order of preference): Highest security level, easiest implementability, fastest run-time.

Edit: I removed the ECDH unit as the question is way more interesting this way. The ECDH unit can solve the problem using ElGamal and an ECIES like approach.

• Can you use the ECDH unit for elGamal? $\;$ – user991 Aug 12 '15 at 0:26
• @RickyDemer, I think this would be possible. But I don't know of any reliable way to convert a random 256-bit string to a 256 or 320 bit curve point. – SEJPM Aug 12 '15 at 9:36
• – user991 Aug 12 '15 at 16:58
• @RickyDemer, thank you, I have solved the problem now by using the ECDH unit to do ElGamal Encryption. I avoided the problem of the mapping by doing what ECIES does: Randomly choose a point and derive the key from that one and then perform the above protocol with ElGamal. This should give me the IND-CCA1 security. I'll edit the ECDH unit now out of the question so we have the more interesting part of finding such a RSA conversion as main focus point and motivation for theoretical research. – SEJPM Aug 12 '15 at 18:02