In RSA-OAEP given a fixed and a known value for the seed, is it possible to recover message using its ciphertext and the public key $(n,e)$?

  • 2
    Hint: in textbook RSA where ciphertext for encryption of $m$ is $m^e\bmod n$, if you know the ciphertext and $(n,e)$, and that $m$ belongs to a small set (e.g. $m$ is one of the names on the class roll converted to integer per some known convention, and you have the class roll), what is a straightforward method to find $m$ ? Can this be extended to the case at hand ? RSAES-OAEP encryption is defined there, with seed appearing at step 2d. – fgrieu Dec 1 at 7:11
  • based on RFC-8017 Page. 23, if you know the seed, you just know a part of the maskedDB. MaskedSeed is the challenging part because its value is depend on the output of MGF(maskedSeed). Since the MGF(.) is based on a hash function, say SHA-1, the output of MGF(x) is depend on all bits of x. So, we just know a few bits of message and the set of all candidates messages is not small. – H.S Dec 2 at 12:33
  • Not the right line of thought. Notice that if you know seed (and $L$, conventionally empty unless stated otherwise), then $\mathrm{EM}$ becomes a function of $M$. Hence $m$ becomes a function of $M$. Hence the attack that I hint for textbook RSA can be performed. It works for small message space (as often found in practice, e.g. credit card number). For large plaintext space, that's still a working "chosen plaintext" attack (as part of the original question, but removed by @kelalaka). – fgrieu Dec 2 at 12:46

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.