I have two questions about RSA encryption to confirm:

  1. Assume use RSA 2048-bit key pair, what is the secure encryption mode? Are ECB / OAEPWithSHA-256AndMGF1Padding and ECB / OAEPWithSHA-1AndMGF1Padding secure modes?

  2. For example, we know the maximim length of plaintext to be encrypted is limited by key length.

RSA was not designed to work with large amount of data. You can process messages only with limited length, that depends on the key size. The bigger key is, the bigger message can be encrypted.

For 2048 key, what is the maximum plaintext length? What is the math relation between them?


1 Answer 1


Lets assume Java here. In that case the ECB part of the name is a misnomer. ECB is the most simple mode for a block cipher. It means splitting up the plaintext message into multipe blocks and then encrypting them separately. Java's RSA implementation doesn't split anything up, you can only encrypt a single block of plaintext. They should have used "None" instead or have left it out altogether.

Yes, OAEP is secure, if implemented correctly. It requires a mask generation function parameterized with a cryptographically secure hash function. You can compare MGF1 with a key derivation function. For that kind of usages SHA-1 is still secure. I'd still prefer SHA-256 none-the-less, if just to avoid nasty questions on the protocol. It is plenty fast for this kind of use and new processors even contain instructions to speed up the algorithm.

For the maximum plaintext message I'll simply refer to a previous answer. It lists a payload size of 214 bytes for SHA-1 and 190 bytes for SHA-256 if OAEP is used.

  • $\begingroup$ Yes, Java. For same plaintext and RSA key, ciphertext is different for every time encryption? Under None/OAEP $\endgroup$
    – TJCLK
    Commented Apr 22, 2020 at 15:53
  • $\begingroup$ Yes, ciphertext is suppored to change for each encryption. Otherwise you could for instance encrypt "Affirmative" twice, and the adversary can clearly distinguish that it is the same word that was encrypted (you want ciphertext indistinguishablity, to name the term). Note that although Java named it incorrectly, I'd still use "ECB" instead of "None" for the sake of compatibility. $\endgroup$
    – Maarten Bodewes
    Commented Apr 22, 2020 at 15:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.