I know that you should never use RSA with any block cipher mode of operation, but theoretically, what's the best block cipher mode (safest) we can use with RSA encryption - without adding any kind of padding?
I already know that CTR is not the best choice and that ECB with RSA and without padding is a really bad idea cause we can see the repeated blocks, but between CBC, CTR, and OFB, I can't understand what would be the best choice.
The question is asking for a block cipher mode of operation usable with RSA.
Caveat: this is unusual and (almost certainly) not a right or valid solution to the problem at hand. See last section for the secure, common, simple, fast alternative.
RSA with proper random encryption padding (like RSAES-OAEP) is believed to give IND-CPA and even IND-CCA2 confidentiality. But it has limited capacity: like 190-byte message for 256-byte cryptogram (using RSA-2048 and SHA-256). Above that limit, ECB can safely be used if one does not care about the large speed penalty (especially for decryption) and significant size penalty due to repeated use of RSAES-OAEP.
RSA without random encryption padding (textbook RSA) is not secure. In particular, it allows to check a guess of the plaintext. Also, care must be taken that a plaintext block should be at least 1 bit less than than the public modulus is.
None of the modes of operation used for symmetric block ciphers make RSA secure:
Secure variations would amount to a specialized random padding. I'll refrain from suggesting any.
An efficient (and the most used in practice) solution to the problem of encrypting large messages with RSA is hybrid encryption: symmetric encryption with a random key, and encryption of that key per RSA. A slightly different option is RSA-KEM, where the key is secured (not encrypted) using RSA.
