Skip to main content

# Questions tagged [oaep]

Optimal Asymmetric Encryption Padding is a padding scheme for RSA, codifying how short plaintext is enciphered and deciphered. It has a security reduction to the RSA problem.

68 questions
Filter by
Sorted by
Tagged with
2 votes
0 answers
74 views

### On the security of OAEP

I saw theorems stating that RSA-OAEP (or the similar variant OAEP+) is CCA-secure in the random oracle model. I wonder about the following: Is RSA-OAEP (or even OAEP+) CPA-secure in the plain model? ...
• 21
3 votes
3 answers
2k views

### RSA different ciphertext for the same plaintext

General My goal is to encrypt some strings and store them in a database. I am using RSA OAEP in Go (Golang): ...
0 votes
1 answer
241 views

### How is RSA-OAEP secure from CCA2?

Here the encryption is done as follows : $$C=P^e \textrm{mod} \, n =(P_1||P_2)^e \textrm{mod} \, n.$$ Here's my scenario that the adversary with CCA2 wins. The adversary chooses $X_1, X_2$ of the same ...
• 363
0 votes
0 answers
67 views

### Is there a public-key, "deal-less", all-or-nothing, "secret-length message" cryptosystem or some easy way to derive it?

I want to make an ecryption algorithm that is secure in, well, really many ways, which is hard I see, so I came up with some ideas of how to implement it using some primitives that I know and I ...
• 125
1 vote
3 answers
391 views

### is RSA KTS-OAEP necessary? [duplicate]

Often data is encrypted using Symmetric Ciphers and Symmetric key is shared with recipient by encrypting it with recipient's Asymmetric Public Key. NIST Special Publication 800-56B, Revision 2 section ...
• 2,449
2 votes
1 answer
111 views

### How important is constant-time verification of lHash label in RSA-OAEP?

In my hobbyist project implementation of RSA-OAEP, I omitted support for labels at the beginning. I set the label to empty string on encryption and ignored the label on decryption. Now I'm adding a ...
• 9,451
1 vote
1 answer
145 views

### RSADP/RSAEP with zero base/message value

I have a question about how RSADP/RSAEP are defined (in RFC2437 https://datatracker.ietf.org/doc/html/rfc2437#section-5.1.2): RSADP (and RSAEP) are described with the same limits for the message (m) ...
• 151
3 votes
3 answers
927 views

### Is there an easy way to make textbook RSA secure enough so it can be used in real life?

I have written a raw (textbook) RSA implementation (just for fun) and I wonder is there an easy way to make it secure enough so it can be used in real life (without implementing OAEP+ and RSASSA-PSS)? ...
1 vote
1 answer
411 views

### Break RSA without padding using a rainbow table attack

We are using RSA without OAEP, with a relatively small input domain. Lets assume we have John and Bob connected on a line, and we are eavesdropping them. Bob first sends John his public key (e,n), ...
• 117
2 votes
1 answer
1k views

### Can you please explain how Manger's attack against RSA OAEP works?

I searched but found nothing except the original paper, and I can't wrap my head around it. Can you help me by giving an overview and then if possible, a short explanation of the algo?
• 21
1 vote
0 answers
2k views

### In regard to using RSA-OAEP-256 in JWE to also authenticate token issuer

I'm not an expert on cryptography, so, the understanding below might not be entirely correct. From what I understand, in the context of JWE, the RSA-OAEP-256 key algorithm is meant to provide payload ...
• 11
1 vote
0 answers
411 views

### Would a key recovery attack on ChaCha's keystream would be made more secure with an AONT?

To be clear I'm well aware that ChaCha doesn't need to be "improved". Also, I have no intentions or misguided ideas about trying to "improve" it. My question is hypothetical, and ...
• 1,453
0 votes
1 answer
1k views

### RSA PKCS#1 OAEP Padding Schema - padding 0 for first octet?

In this document, it shows the EM will have one zero octet padding prefixed. ...
• 31
3 votes
2 answers
316 views

### RSA OAEP Error Detection Probability

With reference to this question: First, when using padding (PKCS or OAEP), if the ciphertext has errors in transmission we'll always get an error at the decryption process? where the answer is: Yes,...
• 31
1 vote
1 answer
2k views

### How RSA-OAEP decrypt a Symmetric Key message?

In an RSA-OAEP encrypted symmetric Key (AES for example) message. The message is then decrypted by the other party when R is a Random Number That other party doesn't know about. so How it can retrieve ...
• 403
13 votes
0 answers
299 views

### RSA key such that pi deciphers to your name per RSA-OAEP

Can you efficiently construct an RSA public/private key pair with $8k$-bit public modulus such that $C=\left\lfloor\pi\,2^{8k-2}\right\rfloor$ deciphers per RSA-OAEP to your name as a bytestring in ...
• 142k
1 vote
1 answer
294 views

### RSA Encryption Time with Different Block Sizes

I was working on encrypting a few files on my computer and I was using OAEP for padding with RSA. I noticed that it was taking a long time to encrypt some of my files with a small block size, so I ...
• 11
2 votes
1 answer
738 views

### JWE between Android/iPhone and backend

I'm working on a solution where JWE is needed between an Android app and a backend written in Node.JS, using node-jose. I've been struggling a lot since it seems ...
• 121
4 votes
1 answer
429 views

### How can I prove that ElGamal encryption in $\mathbb{Z}_p^*$ with OAEP padding is ind-CPA secure?

How I can prove that ElGamal encryption in $\mathbb{Z}_p^*$ with Optimal Asymmetric Encryption Padding (OAEP) is IND-CPA secure?
1 vote
1 answer
2k views

### RSA Signing: SHA512 incompatible with PSS?

I am wrapping the RSACng class from the .Net API. Whilst unit testing, I run checks against an array of possibilities: Key Size = 1024, 2048, or 3072 bits Padding ...
• 113
2 votes
1 answer
228 views

### Security of RSA-KEM against cube root attack

In the Key encapsulation article of Wikipedia, the RSA-KEM is described shortly, as follows; Generate a random element $1<m<n$ then drive your symmetric key by $M=\text{KDF}(m)$ Then compute ...
2 votes
1 answer
99 views

### consequences of using fixed values with OAEP

With DSA / ECDSA using a fixed $k$ means the private key can be trivially easily calculated from two different signatures. To remedy this RFC6979 Deterministic Usage of the Digital Signature Algorithm ...
• 2,939
2 votes
2 answers
2k views

### Preferred SHA-2 hash algorithm for MGF1 in RSA

Does it make any difference to the security and efficiency if we use SHA-256 or SHA-512 for the Mask Generation Function MGF1 that generates the masking / padding within the OAEP encryption scheme and ...
• 93.2k
1 vote
1 answer
305 views

### Probabilistic padding to avoid Håstad’s Broadcast Attack

Can someone explain why probabilistic padding like OAEP is particularly useful for avoiding Håstad’s Broadcast Attack? I don't really get the reason why.
3 votes
0 answers
3k views

### OAEP Security: PKCS#1 v1.5 vs SHA1 vs SHA256

I'm looking at two major RSA encryption standards: PKCS#1 ver. 1.5 RSA OAEP The second one can use different hashing functions to create a hash of encoding parameters and then verify the hash at ...
• 366
1 vote
1 answer
2k views

### RSA-OAEP Padding scheme

Honestly I'm really confused about padding in RSA scheme. I don't study computer science, and I'm a beginner learning cryptography (self-taught). Can anyone give me suggestions?
• 81
5 votes
1 answer
135 views

### What are the uses of arbitrary length output hashes (other than OAEP)?

Functions such as SHA-3 from the Keccak family allow for a hash of arbitrary length output. These functions are (according to Wikipedia) useful for practical, lightweight applications. I know that ...
• 6,462
1 vote
1 answer
131 views

### OAEP security with variable length hash function

I'm implementing a hobby cryptosystem for fun and to increase my knowledge on the subject, and I was wondering if the OAEP construct was still sufficient as an all-or-nothing-transform if variable ...
3 votes
2 answers
307 views

### If OAEP is introducing randomness to encryption how could be ciphertext decrypted?

I was studying OAEP and see we introduce a random value $r$ when computing the padding. See the figure below from Wikipedia So if we are adding randomness to encryption, how could this ciphertext be ...
• 131
2 votes
0 answers
129 views

### OAEP Hash function truncation

I am using OAEP in a project and I want the resulting number of bits (n) to be 288 bits. Most of the implementations online seem to be for 1024 bits and using SHA-256 and I was wondering if truncating ...
3 votes
1 answer
382 views

### Is OAEP needed when encrypting a session (random) key using RSA?

My question is two parts: when encrypting a session key which is used to encrypt bulk data using a block cipher for example, is padding with OAEP really needed [i'm assuming the key is generated ...
9 votes
2 answers
3k views

### Is Bouncycastle RSA+OAEP implementation vulnerable to Manger’s attack?

I have written a code to encrypt a plaintext as below. Here I am using bouncycastle crypto provider and referring to the RSA+OAEP for that. ...
• 91
6 votes
1 answer
441 views

### What is the reason for length differences in RSA?

In NIST FIPS 186-4, "digital signature algorithm", the minimal length allowed is 1024 bit (page 22). On the contrary, in NIST SP800-56B, page 63, RSA-OAEP encryption, the minimal length is 2048. Why ...
• 1,076
6 votes
1 answer
13k views

### What's the point of OAEP?

I can't seem to wrap my head around what benefit OAEP provides (specifically with RSA). Lets consider really small numbers for a moment. If the random source in the padding algorithm gave a random ...
3 votes
0 answers
87 views

### OAEP Cryptanalysis with broken hash

Keeping OAEP Cryptanalysis in mind, about the inability to get to $M_1$ or $M_2$ given $\operatorname{OAEP}(M_1) \oplus \operatorname{OAEP}(M_2)$. Would it be possible to get to $M_1$ or $M_2$, given ...
• 209
0 votes
1 answer
192 views

• 209
1 vote
2 answers
373 views

### Distinguish between cipher-texts of text-book RSA and RSA/OAEP

Is there is a possibility to identify from cipher-text that, this is been encrypted using a text-book RSA or RSA with OAEP padding. (By looking at the cipher-text only) ?
• 123
0 votes
1 answer
362 views

### Use of OAEP in RSA Encryption

I am working on creating an RSA Algorithm and learned that OAEP is a padding scheme that is commonly used before encrypting using RSA. Is this step necessary? Will it harm the integrity/security of ...
3 votes
1 answer
440 views

### Role of lHash field in RSAES-OAEP

The RSA encryption padding of RSAES-OAEP has a lHash field set to the hash of a label. That label is typically the empty string, or some public description of the intended use of the message. Does ...
• 142k
13 votes
3 answers
21k views

### Is RSA-OAEP deprecated?

I need asymmetric pub/private keypair encryption in JavaScript. Web browsers support RSA-OAEP, which works exactly as I need. But there is a table which lists supported algorithms for web crypto at ...
• 239
7 votes
1 answer
863 views

### Why is the seed masked in OAEP

In the OAEP padding/armoring scheme for RSA encryption, the seed used is masked (with the masked data block) in the end. Why is that necessary, since the seed is random anyway?
• 2,528
2 votes
1 answer
689 views

### Zero byte header in RSA-OAEP vs. RSA-PSS

PKCS#1 v2.1/RFC3437 defines the OAEP padding mode for encryption and the PSS for signature padding. Both schemes are based on the generic constructions not specifically tailored to RSA by Rogaway &...
• 2,528
4 votes
1 answer
505 views

### Security effects of the seed's length in OAEP

In the OAEP scheme for asymetric encryption padding a random seed is used, whose length can be chosen. The paper which introduced OAEP in 1994 just states, that the seed's length $k_0$ should be ...
• 2,528
2 votes
1 answer
946 views

### What does the mask generation function in PKCS#1 output if the generated mask is shorter than the specified mask length?

I am implementing RSA-OAEP with the mask generation function as specified in PKCS #1. It says after producing the variable T to "output the leading maskLen octets of T as the octet string mask". ...
22 votes
1 answer
26k views

### What is the maximum size of the plaintext message for RSA OAEP?

OAEP is an important technique used to strengthen RSA. However, using OAEP (or any technique that adds randomness) reduces the size of plaintexts that can be encrypted. Assume for instance that OAEP ...
0 votes
1 answer
340 views

### Generation of random data for EME-OAEP

I'm using my own code to communicate with another party that's specified PKCS#1 V2.1 EME-OAEP encoding, with SHA-1 as the hash function. There are two places where random data is used in encoding a ...
• 223
10 votes
1 answer
2k views

### Why did OAEP change from PKCS#1 v2.0 and v2.1?

In PKCS#1 v2.1 the OAEP output is prepending with a null byte. Quoting RFC 3447, ...
• 2,939
7 votes
1 answer
1k views

### In PKCS#1 V2.2, should MGF be based on the same hash function that RSA-OAEP-ENCRYPT uses?

In Section 7.1.1 of PKCS#1 v2.2 there are two options for RSAES-OAEP-Encrypt given: Hash MGF Appendix B.2.1 of the same document states that MGF1 is based on a hash function. Is MGF1 based on the ...
6 votes
2 answers
3k views

### Why is padding the plaintext with a random string before encryption worse than OAEP / PKCS#7?

I'm reading about OAEP / PKCS padding used for PGP to turn deterministic algorithms like RSA from deterministic encryption to probabilistic encryption (randomness in the resulting output). That way ...
• 663