3
$\begingroup$

Is there a way to calculate how much safer RSA-OAEP is compared to RSA with PKCS#1 v1.5 compliant padding? Or is there a good rule of thumb?

$\endgroup$
  • 4
    $\begingroup$ 'Just RSA'; is that raw RSA with no padding whatsoever? $\endgroup$ – poncho May 15 '17 at 18:26
  • $\begingroup$ Analogy: Imagine RSA as a wooden beam. It looks nice and solid and is a nice building block, but won't do anything by itself. Now imagine the OAEP padding to be the nails / screws. Now you can do more sensible stuff with it. $\endgroup$ – SEJPM May 15 '17 at 18:31
  • $\begingroup$ @poncho With PKCS#1 v1.5 padding, didn't realize there was still padding by default in openssl $\endgroup$ – Meltem Coroz May 15 '17 at 18:31
6
$\begingroup$

RSA PKCS#1 is still secure if padding oracles do not apply. If padding oracles apply, for instance when a server verifies the padding after decryption and somehow leaks the result (through an error message or by leaking information about the the verification time) then OAEP is much more secure.

Note that in principle OAEP can also leak information through timing attacks, so just using OAEP is no panacea.


Furthermore, OAEP also has a security proof that the padding should be secure as long as RSA is deemed secure. Although there are no known attacks on PKSC#1 - besides the aforementioned padding oracle attack - the algorithm doesn't have a formal security proof so it is possible that attacks do exist.


These kind of things cannot be easily quantified. RSA has about no security if PKCS#1 padding oracles apply. The lack of security proof may lead to an attack in the future, but this is - very likely - independent of the key size. Neither calculations nor rules-of-thumb apply. You should rather take a good look at your use cases, threat-model and attack vectors.


Or just use OAEP. Many libraries support OAEP because PKCS#1 is deemed less secure.

$\endgroup$
  • 1
    $\begingroup$ Panacea = universal remedy that fixes all $\endgroup$ – Maarten Bodewes May 15 '17 at 18:36
  • 4
    $\begingroup$ Or use RSA KEM and forget about all that padding crap. $\endgroup$ – CodesInChaos May 15 '17 at 21:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.