RSA-KEM is introduced by Yuliang Zheng and Jennifer Seberry

and compared the security against OAEP variant by Jakob Jonsson, in 2002

I've found some documents that may indicate the usage of RSA-KEM in the wild.

What are the noticeable usage of RSA-KEM in the wild as of 2020?

  • $\begingroup$ I'm not aware of anything. It's a good scheme, far more foolproof than OAEP, but I don't see much reason to use it over ECDH, since it's still slower and needs bigger keys. $\endgroup$ Aug 24, 2020 at 14:55
  • 1
    $\begingroup$ Most people will be ignorant of it. You won't find it when looking for RSA encryption standards and it is not much present in libraries. And you need to generate a very large random, although some person created a pretty fast scheme to do that, something with binary compare :). I think the required KDF is a bit more tricky to be honest. You cannot just specify RSA-KEM. You also need to specify the KDF and not just the symmetric cipher. KDF's are kind of the dark sheep of crypto it seems. At least TLS 1.3 directly named the function a KDF. $\endgroup$
    – Maarten Bodewes
    Aug 24, 2020 at 21:04
  • $\begingroup$ @MaartenBodewes you are talking like I (we) should not suggest using RSA-KEM anymore. Why the KDF is tricky? I can't see that. Just choose HKDF? Yes, TLS did and a bit more complex. $\endgroup$
    – kelalaka
    Aug 24, 2020 at 21:08
  • 2
    $\begingroup$ I'm not saying that you should not use it, I'm trying to indicate why it doesn't seem to be used much. I'm all for it, indeed if RSA itself is required. ECIES seems more logical and although it requires you to store the public key, it will still outperform RSA - if we disregard quantum computers of course. $\endgroup$
    – Maarten Bodewes
    Aug 24, 2020 at 21:12
  • 3
    $\begingroup$ Note that NIST has not standardized RSA-KEM. RSA-KEM seems only standardized in ISO/IEC 18033-2:2006. ENISA has mentioned it in their document of 2013, but that contains more secure-but-obscure algorithms. If you want to keep to NIST standardized algorithms then RSA-KEM is out of scope. $\endgroup$
    – Maarten Bodewes
    Nov 18, 2020 at 11:12


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.