I need asymmetric pub/private keypair encryption in JavaScript. Web browsers support RSA-OAEP, which works exactly as I need. But there is a table which lists supported algorithms for web crypto at https://diafygi.github.io/webcrypto-examples/ ... and RSA-OAEP is marked using red color (Discouraged, only use for backwards compatibility).

Is there any problem with RSA-OAEP? Should it be replaced by different algos? Or do you think that the person who wrote the table was wrong by marking RSA-OAEP red? Thank you

  • 2
    $\begingroup$ On github the question was asked about sources - and notice the distinct lack of an answer. The table probably shows only a personal preference - but that's also just speculation. $\endgroup$ – tylo Sep 19 '17 at 15:34
  • $\begingroup$ Maybe inspired by blog.trailofbits.com/2019/07/08/fuck-rsa $\endgroup$ – Fractalice Jan 19 at 20:10

RSA in general is often considered to be "discouraged" for new projects. For quite some years, the rallying cry has been "switch to elliptic curves", but nowadays there are calls for going straight for so-called "post-quantum" schemes.

RSA benefits from having survived a lot of public scrutiny (arguably, integer factorization is a problem that has been studied for three millennia at least), and while there has been substantial progress in cryptanalysis, 2048-bit RSA key are likely to remain secure for a long time. There are also good and bad ways to use RSA for asymmetric encryption, but RSA-OAEP is about as good as you can get with RSA, so that's fine.

Elliptic curves offer better performance (on the decryption side) and are more fashionable. What this means is that before being actually broken, RSA may become disused, meaning that you will get interoperability issues, and implementations will be poorly maintained at some point. In my view, none of this is critical.

Quantum computers eat RSA keys for breakfast; however, they also munge through elliptic curves at lunch time, so that's not a good argument for switching to curves. It's a fortunate thing that quantum computers don't really exist yet (and whether they will exist at some point is an open question). "Post-quantum" schemes are algorithms that appear to resist quantum computers (specifically, these are algorithms for which no efficient quantum-solving attack is known – which does not mean that such attacks don't exist!). There is no real post-quantum drop-in replacement for classic algorithms yet (there are good candidates, but a lot of standardization and implementation deployment is still needed).


You'll have to ask the author of that site why they made that assessment.

Although there's no technical reason to prefer RSA-OAEP over the much simpler (to implement and to study) RSA-KEM, RSA-OAEP is more widely standardized and deployed, as RSAES-OAEP in PKCS#1 v2.

There are other RSA-based public-key encryption schemes out there, but since that site doesn't list any of them, my only guess is that the author of that site prefers ECDH-based public-key key encapsulation methods over all RSA-based public-key encryption schemes.

But largely, WebCrypto was based on parroting standards full of acronym soup for backwards compatibility with archaic pantheons of cryptographic doohickeys, rather than carefully analyzing crypto engineering needs of novel applications like NaCl. So who can say what rhyme or reason goes into the product of that process?

This table itself doesn't help by confounding many unrelated operations and security properties into a single table, as if there were any reason to put RSASSA-PSS and RSAES-OAEP and AES-CMAC and AES-CTR side by side in a single table as if they were comparable types of objects—magic crypto black boxes with a different subset of buttons you can push to summon the crypto fairies.

  • $\begingroup$ I believe the author made an strongly opinion-based decision to deprecate RSA-OAEP in this case. $\endgroup$ – DannyNiu Sep 19 '17 at 1:31
  • $\begingroup$ @DannyNiu: Can you be more specific? Do you mean the author of the table unilaterally decided on the basis of their technical opinion that RSA-OAEP ought to be deprecated, no matter what current practice or standard status is? Or do you mean the WebCrypto editors made the decision that RSA-OAEP should be formally deprecated in the standard, for which one could dig up a citation? $\endgroup$ – Squeamish Ossifrage Sep 19 '17 at 1:47
  • $\begingroup$ I mean the former, that they unilaterally decided on the basis of their own technical opinion. $\endgroup$ – DannyNiu Sep 19 '17 at 1:49
  • $\begingroup$ Although NaCL was developed to be an easy-to-use cryptography library, formal usability testing found that it shared some usability problems with the previous generation of cryptography libraries. For reference, I recommend usenix.org/system/files/soups2019-patnaik.pdf and cl.cam.ac.uk/~rja14/shb17/fahl.pdf. $\endgroup$ – vy32 Jan 18 at 12:07
  • $\begingroup$ To its defense, NaCL aims to be a specific solution to a specific problem (or set of problems really) - it is not supposed to be a compatibility library, and it doesn't use any NIST approved algorithms. So "should I use it" is for instance exactly the type of question that developers should ask. $\endgroup$ – Maarten Bodewes Jan 19 at 10:29

The table that you cite should not be considered authoritative. There is nothing wrong with using RSA-OAEP. It is a well-studied protocol based on RSA primitives and more than twenty years of subsequent research into the nature of cryptographic security.

The primary disadvantage of RSA-OAEP is that the RSA keys are less efficient than than those used by the corresponding elliptic curve operations. By "less efficient" I mean that when you compare RSA and elliptic curve cryptography for keys of similar strength, the RSA keys take longer to generate, they are larger, and they are slower to use for decryption.

With that said, you may be interested in this 2015 article by Koblitz and Menezes that appeared in IEEE Security and Privacy, an unfortunately named article A Riddle Wrapped in an Enigma? The answer seems to be that the math of RSA is better studied and understood than the math of elliptic curves. RSA may offer better resistance against smaller quantum computers than elliptic curve crypto.

Since the largest quantum computers these days have on the order of 50 qubits, and since around 20 million noisy qubits are needed to factor RSA 2048, I think that you'll be fine with RSA-OAEP. Besides, there are no standardized PQ algorithms to use at this point.

  • $\begingroup$ Your reference to Schneier's blog article (which itself is a reference to another paper) is outdated. NSA moved away from 256 bits ECC curves to 384 bits ECC curves (same with SHA). In the transition they favored RSA. $\endgroup$ – A. Hersean Jan 18 at 14:06
  • $\begingroup$ Care to post a more recent reference? $\endgroup$ – vy32 Jan 18 at 20:35
  • $\begingroup$ As linked in wikipedia apps.nsa.gov/iaarchive/programs/iad-initiatives/cnsa-suite.cfm plus from 2015, although wayback doesn't work for me, it's still at cnss.gov/CNSS/issuances/Memoranda.cfm "CNSSAM 02-15" if you accept their cert (@A.Hersean). In fact RSA-3072 is NOT similar in strength to EC-P-384 and SHA-384 (and AES 256 or even 192), but it is accepted here (not really favored) $\endgroup$ – dave_thompson_085 Jan 19 at 3:18
  • $\begingroup$ Hi. I updated my post to include the unfortunately named Koblitz and Menezes article that Schneier was referencing. I'm unable to access the cnss.gov website. However, the web site apps.nsa.gov/iaarchive/programs/iad-initiatives/cnsa-suite.cfm lists RSA as a transition algorithm. This supports my claim that the table cited by OP should not be considered authoritative. $\endgroup$ – vy32 Jan 19 at 17:23
  • $\begingroup$ As I said you need to accept the cert for www.cnss.gov (I wish stack wouldn't hide the www.); US government and military systems not intended for public use have their own set of CAs (aka PKI) which is not normally trusted externally, and how you alter this depends on your browser and/or system. (PS: unless there is only one commenter, which is not the case here, commenters are not notified of your response unless you 'ping' one, and only one, with atsign-user. I saw this update in the recent list, but easily might not have. You as the poster are always notified.) $\endgroup$ – dave_thompson_085 Jan 20 at 1:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.