Questions tagged [oaep]
Optimal Asymmetric Encryption Padding is a padding scheme for RSA, codifying how short plaintext is enciphered and deciphered. It has a security reduction to the RSA problem.
68
questions
2
votes
0
answers
54
views
On the security of OAEP
I saw theorems stating that RSA-OAEP (or the similar variant OAEP+) is CCA-secure in the random oracle model.
I wonder about the following:
Is RSA-OAEP (or even OAEP+) CPA-secure in the plain model? ...
- 21
2
votes
3
answers
1k
views
RSA different ciphertext for the same plaintext
General
My goal is to encrypt some strings and store them in a database.
I am using RSA OAEP in Go (Golang):
...
- 21
0
votes
1
answer
160
views
How is RSA-OAEP secure from CCA2?
Here the encryption is done as follows :
$$C=P^e \textrm{mod} \, n =(P_1||P_2)^e \textrm{mod} \, n.$$
Here's my scenario that the adversary with CCA2 wins.
The adversary chooses $X_1, X_2$ of the same ...
- 363
0
votes
0
answers
66
views
Is there a public-key, "deal-less", all-or-nothing, "secret-length message" cryptosystem or some easy way to derive it?
I want to make an ecryption algorithm that is secure in, well, really many ways, which is hard I see, so I came up with some ideas of how to implement it using some primitives that I know and I ...
- 125
1
vote
3
answers
343
views
is RSA KTS-OAEP necessary? [duplicate]
Often data is encrypted using Symmetric Ciphers and Symmetric key is shared with recipient by encrypting it with recipient's Asymmetric Public Key. NIST Special Publication 800-56B, Revision 2 section ...
- 2,397
2
votes
1
answer
84
views
How important is constant-time verification of lHash label in RSA-OAEP?
In my hobbyist project implementation of RSA-OAEP, I omitted support for labels at the beginning. I set the label to empty string on encryption and ignored the label on decryption.
Now I'm adding a ...
- 8,648
1
vote
1
answer
103
views
RSADP/RSAEP with zero base/message value
I have a question about how RSADP/RSAEP are defined (in RFC2437 https://datatracker.ietf.org/doc/html/rfc2437#section-5.1.2):
RSADP (and RSAEP) are described with the same limits for the message (m) ...
- 141
3
votes
3
answers
792
views
Is there an easy way to make textbook RSA secure enough so it can be used in real life?
I have written a raw (textbook) RSA implementation (just for fun) and I wonder is there an easy way to make it secure enough so it can be used in real life (without implementing OAEP+ and RSASSA-PSS)? ...
1
vote
1
answer
289
views
Break RSA without padding using a rainbow table attack
We are using RSA without OAEP, with a relatively small input domain.
Lets assume we have John and Bob connected on a line, and we are eavesdropping them.
Bob first sends John his public key (e,n), ...
- 97
2
votes
1
answer
734
views
Can you please explain how Manger's attack against RSA OAEP works?
I searched but found nothing except the original paper, and I can't wrap my head around it. Can you help me by giving an overview and then if possible, a short explanation of the algo?
- 21
1
vote
0
answers
1k
views
In regard to using RSA-OAEP-256 in JWE to also authenticate token issuer
I'm not an expert on cryptography, so, the understanding below might not be entirely correct.
From what I understand, in the context of JWE, the RSA-OAEP-256 key algorithm is meant to provide payload ...
- 11
1
vote
0
answers
348
views
Would a key recovery attack on ChaCha's keystream would be made more secure with an AONT?
To be clear I'm well aware that ChaCha doesn't need to be "improved". Also, I have no intentions or misguided ideas about trying to "improve" it. My question is hypothetical, and ...
- 1,443
0
votes
1
answer
822
views
RSA PKCS#1 OAEP Padding Schema - padding 0 for first octet?
In this document, it shows the EM will have one zero octet padding prefixed.
...
- 31
3
votes
2
answers
285
views
RSA OAEP Error Detection Probability
With reference to this question:
First, when using padding (PKCS or OAEP), if the ciphertext has errors in transmission we'll always get an error at the decryption process?
where the answer is:
Yes,...
- 31
1
vote
1
answer
1k
views
How RSA-OAEP decrypt a Symmetric Key message?
In an RSA-OAEP encrypted symmetric Key (AES for example) message. The message is then decrypted by the other party when R is a Random Number That other party doesn't know about. so How it can retrieve ...
- 403
13
votes
0
answers
293
views
RSA key such that pi deciphers to your name per RSA-OAEP
Can you efficiently construct an RSA public/private key pair with $8k$-bit public modulus such that $C=\left\lfloor\pi\,2^{8k-2}\right\rfloor$ deciphers per RSA-OAEP to your name as a bytestring in ...
- 137k
1
vote
1
answer
256
views
RSA Encryption Time with Different Block Sizes
I was working on encrypting a few files on my computer and I was using OAEP for padding with RSA. I noticed that it was taking a long time to encrypt some of my files with a small block size, so I ...
- 11
2
votes
1
answer
602
views
JWE between Android/iPhone and backend
I'm working on a solution where JWE is needed between an Android app and a backend written in Node.JS, using node-jose. I've been struggling a lot since it seems ...
- 121
4
votes
1
answer
390
views
How can I prove that ElGamal encryption in $\mathbb{Z}_p^*$ with OAEP padding is ind-CPA secure?
How I can prove that ElGamal encryption in $\mathbb{Z}_p^*$ with Optimal Asymmetric Encryption Padding (OAEP) is IND-CPA secure?
- 143
1
vote
1
answer
2k
views
RSA Signing: SHA512 incompatible with PSS?
I am wrapping the RSACng class from the .Net API.
Whilst unit testing, I run checks against an array of possibilities:
Key Size = 1024, 2048, or 3072 bits
Padding ...
- 113
2
votes
1
answer
183
views
Security of RSA-KEM against cube root attack
In the Key encapsulation article of Wikipedia, the RSA-KEM is described shortly, as follows;
Generate a random element $1<m<n$ then drive your symmetric key by $M=\text{KDF}(m)$
Then compute ...
- 276
2
votes
1
answer
79
views
consequences of using fixed values with OAEP
With DSA / ECDSA using a fixed $k$ means the private key can be trivially easily calculated from two different signatures. To remedy this RFC6979 Deterministic Usage of the Digital Signature Algorithm ...
- 2,875
2
votes
2
answers
2k
views
Preferred SHA-2 hash algorithm for MGF1 in RSA
Does it make any difference to the security and efficiency if we use SHA-256 or SHA-512 for the Mask Generation Function MGF1 that generates the masking / padding within the OAEP encryption scheme and ...
- 91.2k
1
vote
1
answer
245
views
Probabilistic padding to avoid Håstad’s Broadcast Attack
Can someone explain why probabilistic padding like OAEP is particularly useful for avoiding Håstad’s Broadcast Attack? I don't really get the reason why.
- 11
3
votes
0
answers
3k
views
OAEP Security: PKCS#1 v1.5 vs SHA1 vs SHA256
I'm looking at two major RSA encryption standards:
PKCS#1 ver. 1.5
RSA OAEP
The second one can use different hashing functions to create a hash of encoding parameters and then verify the hash at ...
- 346
1
vote
1
answer
2k
views
RSA-OAEP Padding scheme
Honestly I'm really confused about padding in RSA scheme. I don't study computer science, and I'm a beginner learning cryptography (self-taught). Can anyone give me suggestions?
- 81
5
votes
1
answer
124
views
What are the uses of arbitrary length output hashes (other than OAEP)?
Functions such as SHA-3 from the Keccak family allow for a hash of arbitrary length output. These functions are (according to Wikipedia) useful for practical, lightweight applications.
I know that ...
- 6,386
1
vote
1
answer
129
views
OAEP security with variable length hash function
I'm implementing a hobby cryptosystem for fun and to increase my knowledge on the subject, and I was wondering if the OAEP construct was still sufficient as an all-or-nothing-transform if variable ...
- 189
3
votes
2
answers
262
views
If OAEP is introducing randomness to encryption how could be ciphertext decrypted?
I was studying OAEP and see we introduce a random value $r$ when computing the padding. See the figure below from Wikipedia
So if we are adding randomness to encryption, how could this ciphertext be ...
- 131
2
votes
0
answers
125
views
OAEP Hash function truncation
I am using OAEP in a project and I want the resulting number of bits (n) to be 288 bits. Most of the implementations online seem to be for 1024 bits and using SHA-256 and I was wondering if truncating ...
- 21
3
votes
1
answer
358
views
Is OAEP needed when encrypting a session (random) key using RSA?
My question is two parts:
when encrypting a session key which is used to encrypt bulk data using a block cipher for example, is padding with OAEP really needed [i'm assuming the key is generated ...
- 33
9
votes
2
answers
3k
views
Is Bouncycastle RSA+OAEP implementation vulnerable to Manger’s attack?
I have written a code to encrypt a plaintext as below. Here I am using bouncycastle crypto provider and referring to the RSA+OAEP for that.
...
- 91
6
votes
1
answer
434
views
What is the reason for length differences in RSA?
In NIST FIPS 186-4, "digital signature algorithm", the minimal length allowed is 1024 bit (page 22). On the contrary, in NIST SP800-56B, page 63, RSA-OAEP encryption, the minimal length is 2048. Why ...
- 1,066
5
votes
1
answer
11k
views
What's the point of OAEP?
I can't seem to wrap my head around what benefit OAEP provides (specifically with RSA). Lets consider really small numbers for a moment. If the random source in the padding algorithm gave a random ...
- 71
3
votes
0
answers
84
views
OAEP Cryptanalysis with broken hash
Keeping OAEP Cryptanalysis in mind, about the inability to get to $M_1$ or $M_2$ given $\operatorname{OAEP}(M_1) \oplus \operatorname{OAEP}(M_2)$.
Would it be possible to get to $M_1$ or $M_2$, given ...
- 199
0
votes
1
answer
186
views
Brute-force attack on OAEP
Assume $M_1$ is $\operatorname{OAEP}$ padded and encrypted and the ciphertext is 1024 bytes as an example. If an adversary somehow gets around the encryption and manages to get half of the bits of $\...
- 199
2
votes
1
answer
199
views
OAEP Cryptanalysis
If $M_1$ and $M_2$ are $\operatorname{OAEP}$ padded, encrypted and sent and an adversary somehow manages to get around the encryption and retrieve $\operatorname{OAEP}(M_1) \oplus \operatorname{OAEP}(...
- 199
1
vote
2
answers
357
views
Distinguish between cipher-texts of text-book RSA and RSA/OAEP
Is there is a possibility to identify from cipher-text that, this is been encrypted using a text-book RSA or RSA with OAEP padding. (By looking at the cipher-text only) ?
- 123
0
votes
1
answer
331
views
Use of OAEP in RSA Encryption
I am working on creating an RSA Algorithm and learned that OAEP is a padding scheme that is commonly used before encrypting using RSA. Is this step necessary? Will it harm the integrity/security of ...
- 3
3
votes
1
answer
405
views
Role of lHash field in RSAES-OAEP
The RSA encryption padding of RSAES-OAEP has a lHash field set to the hash of a label. That label is typically the empty string, or some public description of the intended use of the message.
Does ...
- 137k
13
votes
3
answers
19k
views
Is RSA-OAEP deprecated?
I need asymmetric pub/private keypair encryption in JavaScript. Web browsers support RSA-OAEP, which works exactly as I need. But there is a table which lists supported algorithms for web crypto at ...
- 239
7
votes
1
answer
793
views
Why is the seed masked in OAEP
In the OAEP padding/armoring scheme for RSA encryption, the seed used is masked (with the masked data block) in the end. Why is that necessary, since the seed is random anyway?
- 2,508
2
votes
1
answer
638
views
Zero byte header in RSA-OAEP vs. RSA-PSS
PKCS#1 v2.1/RFC3437 defines the OAEP padding mode for encryption and the PSS for signature padding. Both schemes are based on the generic constructions not specifically tailored to RSA by Rogaway &...
- 2,508
4
votes
1
answer
477
views
Security effects of the seed's length in OAEP
In the OAEP scheme for asymetric encryption padding a random seed is used, whose length can be chosen. The paper which introduced OAEP in 1994 just states, that the seed's length $k_0$ should be ...
- 2,508
2
votes
1
answer
887
views
What does the mask generation function in PKCS#1 output if the generated mask is shorter than the specified mask length?
I am implementing RSA-OAEP with the mask generation function as specified in PKCS #1. It says after producing the variable T to "output the leading maskLen octets of T as the octet string mask". ...
user41777
22
votes
1
answer
23k
views
What is the maximum size of the plaintext message for RSA OAEP?
OAEP is an important technique used to strengthen RSA. However, using OAEP
(or any technique that adds randomness) reduces the size of plaintexts that can be encrypted.
Assume for instance that OAEP ...
Sarkar
0
votes
1
answer
328
views
Generation of random data for EME-OAEP
I'm using my own code to communicate with another party that's specified PKCS#1 V2.1 EME-OAEP encoding, with SHA-1 as the hash function.
There are two places where random data is used in encoding a ...
- 223
10
votes
1
answer
1k
views
Why did OAEP change from PKCS#1 v2.0 and v2.1?
In PKCS#1 v2.1 the OAEP output is prepending with a null byte. Quoting RFC 3447,
...
- 2,875
7
votes
1
answer
1k
views
In PKCS#1 V2.2, should MGF be based on the same hash function that RSA-OAEP-ENCRYPT uses?
In Section 7.1.1 of PKCS#1 v2.2 there are two options for RSAES-OAEP-Encrypt given:
Hash
MGF
Appendix B.2.1 of the same document states that MGF1 is based on a hash function.
Is MGF1 based on the ...
- 209
6
votes
2
answers
3k
views
Why is padding the plaintext with a random string before encryption worse than OAEP / PKCS#7?
I'm reading about OAEP / PKCS padding used for PGP to turn deterministic algorithms like RSA from deterministic encryption to probabilistic encryption (randomness in the resulting output). That way ...
- 663