Questions tagged [oaep]

Optimal Asymmetric Encryption Padding is a padding scheme for RSA, codifying how short plaintext is enciphered and deciphered. It has a security reduction to the RSA problem.

Filter by
Sorted by
Tagged with
0 votes
1 answer
39 views

How is RSA-OAEP secure from CCA2?

Here the encryption is done as follows : $$C=P^e \textrm{mod} \, n =(P_1||P_2)^e \textrm{mod} \, n.$$ Here's my scenario that the adversary with CCA2 wins. The adversary chooses $X_1, X_2$ of the same ...
user avatar
0 votes
0 answers
51 views

Does this encryption scheme have any major vulnerabilities?

Recently I asked a question of whether there is any cryptosystem that satisfies a number of properties (read the properties). Continuing to the promise I gave there, this is my attempt to construct it....
user avatar
  • 115
0 votes
0 answers
65 views

Is there a public-key, "deal-less", all-or-nothing, "secret-length message" cryptosystem or some easy way to derive it?

I want to make an ecryption algorithm that is secure in, well, really many ways, which is hard I see, so I came up with some ideas of how to implement it using some primitives that I know and I ...
user avatar
  • 115
1 vote
3 answers
239 views

is RSA KTS-OAEP necessary? [duplicate]

Often data is encrypted using Symmetric Ciphers and Symmetric key is shared with recipient by encrypting it with recipient's Asymmetric Public Key. NIST Special Publication 800-56B, Revision 2 section ...
user avatar
  • 1,998
2 votes
1 answer
48 views

How important is constant-time verification of lHash label in RSA-OAEP?

In my hobbyist project implementation of RSA-OAEP, I omitted support for labels at the beginning. I set the label to empty string on encryption and ignored the label on decryption. Now I'm adding a ...
user avatar
  • 6,785
1 vote
1 answer
54 views

RSADP/RSAEP with zero base/message value

I have a question about how RSADP/RSAEP are defined (in RFC2437 https://datatracker.ietf.org/doc/html/rfc2437#section-5.1.2): RSADP (and RSAEP) are described with the same limits for the message (m) ...
user avatar
  • 141
3 votes
3 answers
552 views

Is there an easy way to make textbook RSA secure enough so it can be used in real life?

I have written a raw (textbook) RSA implementation (just for fun) and I wonder is there an easy way to make it secure enough so it can be used in real life (without implementing OAEP+ and RSASSA-PSS)? ...
user avatar
1 vote
1 answer
143 views

Break RSA without padding using a rainbow table attack

We are using RSA without OAEP, with a relatively small input domain. Lets assume we have John and Bob connected on a line, and we are eavesdropping them. Bob first sends John his public key (e,n), ...
user avatar
2 votes
1 answer
330 views

Can you please explain how Manger's attack against RSA OAEP works?

I searched but found nothing except the original paper, and I can't wrap my head around it. Can you help me by giving an overview and then if possible, a short explanation of the algo?
user avatar
  • 21
1 vote
0 answers
692 views

In regard to using RSA-OAEP-256 in JWE to also authenticate token issuer

I'm not an expert on cryptography, so, the understanding below might not be entirely correct. From what I understand, in the context of JWE, the RSA-OAEP-256 key algorithm is meant to provide payload ...
user avatar
  • 11
1 vote
0 answers
162 views

Would a key recovery attack on ChaCha's keystream would be made more secure with an AONT?

To be clear I'm well aware that ChaCha doesn't need to be "improved". Also, I have no intentions or misguided ideas about trying to "improve" it. My question is hypothetical, and ...
user avatar
  • 1,423
0 votes
1 answer
538 views

RSA PKCS#1 OAEP Padding Schema - padding 0 for first octet?

In this document, it shows the EM will have one zero octet padding prefixed. ...
user avatar
  • 21
2 votes
2 answers
227 views

RSA OAEP Error Detection Probability

With reference to this question: First, when using padding (PKCS or OAEP), if the ciphertext has errors in transmission we'll always get an error at the decryption process? where the answer is: Yes,...
user avatar
  • 21
1 vote
1 answer
806 views

How RSA-OAEP decrypt a Symmetric Key message?

In an RSA-OAEP encrypted symmetric Key (AES for example) message. The message is then decrypted by the other party when R is a Random Number That other party doesn't know about. so How it can retrieve ...
user avatar
  • 373
12 votes
0 answers
262 views

RSA key such that pi deciphers to your name per RSA-OAEP

Can you efficiently construct an RSA public/private key pair with $8k$-bit public modulus such that $C=\left\lfloor\pi\,2^{8k-2}\right\rfloor$ deciphers per RSA-OAEP to your name as a bytestring in ...
user avatar
  • 125k
1 vote
1 answer
173 views

RSA Encryption Time with Different Block Sizes

I was working on encrypting a few files on my computer and I was using OAEP for padding with RSA. I noticed that it was taking a long time to encrypt some of my files with a small block size, so I ...
user avatar
  • 11
2 votes
1 answer
394 views

JWE between Android/iPhone and backend

I'm working on a solution where JWE is needed between an Android app and a backend written in Node.JS, using node-jose. I've been struggling a lot since it seems ...
user avatar
  • 121
4 votes
1 answer
314 views

How can I prove that ElGamal encryption in $\mathbb{Z}_p^*$ with OAEP padding is ind-CPA secure?

How I can prove that ElGamal encryption in $\mathbb{Z}_p^*$ with Optimal Asymmetric Encryption Padding (OAEP) is IND-CPA secure?
user avatar
1 vote
1 answer
1k views

RSA Signing: SHA512 incompatible with PSS?

I am wrapping the RSACng class from the .Net API. Whilst unit testing, I run checks against an array of possibilities: Key Size = 1024, 2048, or 3072 bits Padding ...
user avatar
  • 113
2 votes
1 answer
153 views

Security of RSA-KEM against cube root attack

In the Key encapsulation article of Wikipedia, the RSA-KEM is described shortly, as follows; Generate a random element $1<m<n$ then drive your symmetric key by $M=\text{KDF}(m)$ Then compute ...
user avatar
2 votes
1 answer
48 views

consequences of using fixed values with OAEP

With DSA / ECDSA using a fixed $k$ means the private key can be trivially easily calculated from two different signatures. To remedy this RFC6979 Deterministic Usage of the Digital Signature Algorithm ...
user avatar
  • 2,775
2 votes
2 answers
1k views

Preferred SHA-2 hash algorithm for MGF1 in RSA

Does it make any difference to the security and efficiency if we use SHA-256 or SHA-512 for the Mask Generation Function MGF1 that generates the masking / padding within the OAEP encryption scheme and ...
user avatar
  • 85.8k
1 vote
1 answer
201 views

Probabilistic padding to avoid Håstad’s Broadcast Attack

Can someone explain why probabilistic padding like OAEP is particularly useful for avoiding Håstad’s Broadcast Attack? I don't really get the reason why.
user avatar
  • 11
3 votes
0 answers
2k views

OAEP Security: PKCS#1 v1.5 vs SHA1 vs SHA256

I'm looking at two major RSA encryption standards: PKCS#1 ver. 1.5 RSA OAEP The second one can use different hashing functions to create a hash of encoding parameters and then verify the hash at ...
user avatar
  • 316
0 votes
1 answer
2k views

RSA-OAEP Padding scheme

Honestly I'm really confused about padding in RSA scheme. I don't study computer science, and I'm a beginner learning cryptography (self-taught). Can anyone give me suggestions?
user avatar
  • 71
5 votes
1 answer
111 views

What are the uses of arbitrary length output hashes (other than OAEP)?

Functions such as SHA-3 from the Keccak family allow for a hash of arbitrary length output. These functions are (according to Wikipedia) useful for practical, lightweight applications. I know that ...
user avatar
  • 6,326
1 vote
1 answer
123 views

OAEP security with variable length hash function

I'm implementing a hobby cryptosystem for fun and to increase my knowledge on the subject, and I was wondering if the OAEP construct was still sufficient as an all-or-nothing-transform if variable ...
user avatar
3 votes
2 answers
173 views

If OAEP is introducing randomness to encryption how could be ciphertext decrypted?

I was studying OAEP and see we introduce a random value $r$ when computing the padding. See the figure below from Wikipedia So if we are adding randomness to encryption, how could this ciphertext be ...
user avatar
  • 131
2 votes
0 answers
108 views

OAEP Hash function truncation

I am using OAEP in a project and I want the resulting number of bits (n) to be 288 bits. Most of the implementations online seem to be for 1024 bits and using SHA-256 and I was wondering if truncating ...
user avatar
3 votes
1 answer
276 views

Is OAEP needed when encrypting a session (random) key using RSA?

My question is two parts: when encrypting a session key which is used to encrypt bulk data using a block cipher for example, is padding with OAEP really needed [i'm assuming the key is generated ...
user avatar
9 votes
2 answers
2k views

Is Bouncycastle RSA+OAEP implementation vulnerable to Manger’s attack?

I have written a code to encrypt a plaintext as below. Here I am using bouncycastle crypto provider and referring to the RSA+OAEP for that. ...
user avatar
  • 91
6 votes
1 answer
391 views

What is the reason for length differences in RSA?

In NIST FIPS 186-4, "digital signature algorithm", the minimal length allowed is 1024 bit (page 22). On the contrary, in NIST SP800-56B, page 63, RSA-OAEP encryption, the minimal length is 2048. Why ...
user avatar
4 votes
1 answer
10k views

What's the point of OAEP?

I can't seem to wrap my head around what benefit OAEP provides (specifically with RSA). Lets consider really small numbers for a moment. If the random source in the padding algorithm gave a random ...
user avatar
3 votes
0 answers
79 views

OAEP Cryptanalysis with broken hash

Keeping OAEP Cryptanalysis in mind, about the inability to get to $M_1$ or $M_2$ given $\operatorname{OAEP}(M_1) \oplus \operatorname{OAEP}(M_2)$. Would it be possible to get to $M_1$ or $M_2$, given ...
user avatar
0 votes
1 answer
162 views

Brute-force attack on OAEP

Assume $M_1$ is $\operatorname{OAEP}$ padded and encrypted and the ciphertext is 1024 bytes as an example. If an adversary somehow gets around the encryption and manages to get half of the bits of $\...
user avatar
2 votes
1 answer
189 views

OAEP Cryptanalysis

If $M_1$ and $M_2$ are $\operatorname{OAEP}$ padded, encrypted and sent and an adversary somehow manages to get around the encryption and retrieve $\operatorname{OAEP}(M_1) \oplus \operatorname{OAEP}(...
user avatar
1 vote
2 answers
263 views

Distinguish between cipher-texts of text-book RSA and RSA/OAEP

Is there is a possibility to identify from cipher-text that, this is been encrypted using a text-book RSA or RSA with OAEP padding. (By looking at the cipher-text only) ?
user avatar
  • 123
0 votes
1 answer
311 views

Use of OAEP in RSA Encryption

I am working on creating an RSA Algorithm and learned that OAEP is a padding scheme that is commonly used before encrypting using RSA. Is this step necessary? Will it harm the integrity/security of ...
user avatar
3 votes
1 answer
362 views

Role of lHash field in RSAES-OAEP

The RSA encryption padding of RSAES-OAEP has a lHash field set to the hash of a label. That label is typically the empty string, or some public description of the intended use of the message. Does ...
user avatar
  • 125k
11 votes
3 answers
16k views

Is RSA-OAEP deprecated?

I need asymmetric pub/private keypair encryption in JavaScript. Web browsers support RSA-OAEP, which works exactly as I need. But there is a table which lists supported algorithms for web crypto at ...
user avatar
  • 219
7 votes
1 answer
675 views

Why is the seed masked in OAEP

In the OAEP padding/armoring scheme for RSA encryption, the seed used is masked (with the masked data block) in the end. Why is that necessary, since the seed is random anyway?
user avatar
  • 2,458
1 vote
1 answer
586 views

Zero byte header in RSA-OAEP vs. RSA-PSS

PKCS#1 v2.1/RFC3437 defines the OAEP padding mode for encryption and the PSS for signature padding. Both schemes are based on the generic constructions not specifically tailored to RSA by Rogaway &...
user avatar
  • 2,458
4 votes
1 answer
430 views

Security effects of the seed's length in OAEP

In the OAEP scheme for asymetric encryption padding a random seed is used, whose length can be chosen. The paper which introduced OAEP in 1994 just states, that the seed's length $k_0$ should be ...
user avatar
  • 2,458
2 votes
1 answer
836 views

What does the mask generation function in PKCS#1 output if the generated mask is shorter than the specified mask length?

I am implementing RSA-OAEP with the mask generation function as specified in PKCS #1. It says after producing the variable T to "output the leading maskLen octets of T as the octet string mask". ...
user avatar
22 votes
1 answer
19k views

What is the maximum size of the plaintext message for RSA OAEP?

OAEP is an important technique used to strengthen RSA. However, using OAEP (or any technique that adds randomness) reduces the size of plaintexts that can be encrypted. Assume for instance that OAEP ...
user avatar
0 votes
1 answer
295 views

Generation of random data for EME-OAEP

I'm using my own code to communicate with another party that's specified PKCS#1 V2.1 EME-OAEP encoding, with SHA-1 as the hash function. There are two places where random data is used in encoding a ...
user avatar
  • 223
9 votes
1 answer
1k views

why did oaep change from pkcs1 v2.0 and v2.1?

In PKCS1 v2.1 the OAEP output is prepending with a null byte. Quoting RFC3447, ...
user avatar
  • 2,775
7 votes
1 answer
957 views

In PKCS#1 V2.2, should MGF be based on the same hash function that RSA-OAEP-ENCRYPT uses?

In Section 7.1.1 of PKCS#1 v2.2 there are two options for RSAES-OAEP-Encrypt given: Hash MGF Appendix B.2.1 of the same document states that MGF1 is based on a hash function. Is MGF1 based on the ...
user avatar
6 votes
2 answers
3k views

Why is padding the plaintext with a random string before encryption worse than OAEP / PKCS#7?

I'm reading about OAEP / PKCS padding used for PGP to turn deterministic algorithms like RSA from deterministic encryption to probabilistic encryption (randomness in the resulting output). That way ...
user avatar
  • 675
4 votes
1 answer
292 views

Should we use exponent 3 in RSA-OAEP?

As I understand it the proof that RSA-OAEP is secure in the random oracle model is much tighter for exponent 3. Does that mean that exponent 3 should be chosen?
user avatar
  • 4,653