Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [oaep]

Optimal Asymmetric Encryption Padding is a padding scheme which has been standardized in [PKCS #1v29](http://www.emc.com/collateral/white-papers/h11300-pkcs-1v2-2-rsa-cryptography-standard-wp.pdf) and 8RFC 2437](http://tools.ietf.org/html/rfc2437). OAEP is often used in combination with RSA ...

0
votes
0answers
33 views

Recover message in RSA-OAEP with fixed seed

In RSA-OAEP given a fixed and a known value for the seed, is it possible to recover message using its ciphertext and the public key $(n,e)$?
8
votes
2answers
396 views

Is Bouncycastle RSA+OAEP implementation vulnerable to Manger’s attack?

I have written a code to encrypt a plaintext as below. Here I am using bouncycastle crypto provider and referring to the RSA+OAEP for that. ...
6
votes
1answer
358 views

What is the reason for length differences in RSA?

In NIST FIPS 186-4, "digital signature algorithm", the minimal length allowed is 1024 bit (page 22). On the contrary, in NIST SP800-56B, page 63, RSA-OAEP encryption, the minimal length is 2048. Why ...
2
votes
1answer
799 views

What's the point of OAEP?

I can't seem to wrap my head around what benefit OAEP provides (specifically with RSA). Lets consider really small numbers for a moment. If the random source in the padding algorithm gave a random ...
2
votes
0answers
51 views

OAEP Cryptanalysis with broken hash

Keeping OAEP Cryptanalysis in mind, about the inability to get to $M_1$ or $M_2$ given $\operatorname{OAEP}(M_1) \oplus \operatorname{OAEP}(M_2)$. Would it be possible to get to $M_1$ or $M_2$, given ...
0
votes
1answer
108 views

Brute-force attack on OAEP

Assume $M_1$ is $\operatorname{OAEP}$ padded and encrypted and the ciphertext is 1024 bytes as an example. If an adversary somehow gets around the encryption and manages to get half of the bits of $\...
1
vote
2answers
93 views

Distinguish between cipher-texts of text-book RSA and RSA/OAEP

Is there is a possibility to identify from cipher-text that, this is been encrypted using a text-book RSA or RSA with OAEP padding. (By looking at the cipher-text only) ?
0
votes
1answer
142 views

Use of OAEP in RSA Encryption

I am working on creating an RSA Algorithm and learned that OAEP is a padding scheme that is commonly used before encrypting using RSA. Is this step necessary? Will it harm the integrity/security of ...
3
votes
1answer
137 views

Role of lHash field in RSAES-OAEP

The RSA encryption padding of RSAES-OAEP has a lHash field set to the hash of a label. That label is typically the empty string, or some public description of the intended use of the message. Does ...
6
votes
2answers
3k views

Is RSA-OAEP deprecated?

I need asymmetric pub/private keypair encryption in JavaScript. Web browsers support RSA-OAEP, which works exactly as I need. But there is a table which lists supported algorithms for web crypto at ...
7
votes
1answer
242 views

Why is the seed masked in OAEP

In the OAEP padding/armoring scheme for RSA encryption, the seed used is masked (with the masked data block) in the end. Why is that necessary, since the seed is random anyway?
1
vote
1answer
348 views

Zero byte header in RSA-OAEP vs. RSA-PSS

PKCS#1 v2.1/RFC3437 defines the OAEP padding mode for encryption and the PSS for signature padding. Both schemes are based on the generic constructions not specifically tailored to RSA by Rogaway &...
5
votes
1answer
226 views

Security effects of the seed's length in OAEP

In the OAEP scheme for asymetric encryption padding a random seed is used, whose length can be chosen. The paper which introduced OAEP in 1994 just states, that the seed's length $k_0$ should be ...
3
votes
1answer
321 views

What does the mask generation function in PKCS#1 output if the generated mask is shorter than the specified mask length?

I am implementing RSA-OAEP with the mask generation function as specified in PKCS #1. It says after producing the variable T to "output the leading maskLen octets of T as the octet string mask". ...
6
votes
1answer
4k views

What is the maximum size of the plaintext message for RSA OAEP?

OAEP is an important technique used to strengthen RSA. However, using OAEP (or any technique that adds randomness) reduces the size of plaintexts that can be encrypted. Assume for instance that OAEP ...
0
votes
1answer
129 views

Generation of random data for EME-OAEP

I'm using my own code to communicate with another party that's specified PKCS#1 V2.1 EME-OAEP encoding, with SHA-1 as the hash function. There are two places where random data is used in encoding a ...
8
votes
1answer
415 views

why did oaep change from pkcs1 v2.0 and v2.1?

In PKCS1 v2.1 the OAEP output is prepending with a null byte. Quoting RFC3447, ...
6
votes
1answer
342 views

In PKCS#1 V2.2, should MGF be based on the same hash function that RSA-OAEP-ENCRYPT uses?

In Section 7.1.1 of PKCS#1 v2.2 there are two options for RSAES-OAEP-Encrypt given: Hash MGF Appendix B.2.1 of the same document states that MGF1 is based on a hash function. Is MGF1 based on the ...
1
vote
2answers
1k views

Why is padding the plaintext with a random string before encryption worse than OAEP / PKCS#7?

I'm reading about OAEP / PKCS padding used for PGP to turn deterministic algorithms like RSA from deterministic encryption to probabilistic encryption (randomness in the resulting output). That way ...
1
vote
0answers
39 views

Should we use exponent 3 in RSA-OAEP?

As I understand it the proof that RSA-OAEP is secure in the random oracle model is much tighter for exponent 3. Does that mean that exponent 3 should be chosen?
3
votes
1answer
336 views

Is RSA encryption without padding secure with NIST Key Establishment schemes?

NIST SP800-56B standard (addressing IFC-based Key Establishment schemes) defines some key establishment (KE) schemes using the RSASVE primitive in which the common secret $Z$ is encrypted with RSA-EP ...
1
vote
1answer
305 views

Can RSA with padding detect all errors in ciphertext?

I'm new in cryptography and there are a couple of things that i'm not sure if i understand correctly. First, when using padding (PKCS or OAEP), if the chiphertext has errors in transmission we'll we ...
2
votes
1answer
1k views

RSA-OAEP: How does it work?

I was looking at this image about OAEP: ..and was wondering what was happening here. We have a data block DB which consists of: ...
4
votes
1answer
355 views

Does rsa-oaep provide or not plaintext integrity in addition to confidentiality?

My own understanding (possibly wrong of course) of RSA-OAEP encryption scheme is that it provides plaintext integrity (in addition to confidentiality) due to MGF function which for encryption ...
1
vote
1answer
2k views

RSA Optimal Asymmetric Encryption Padding Beginner

I'm new to the OAEP scheme. I learn it from the Wikipedia page. Link The page does not explain a proper setup for of the system. So I'm not sure if the output of the padding scheme which contains ...
1
vote
0answers
38 views

Is using same key pair for both encryption and signing secure in RSA [duplicate]

In GPG, we can use same key pair for encryption and signing. Can't/Shouldn't we do this in RSA. I am using RSAES-OAEP and RSASSA-PSS, not raw RSA btw.
5
votes
1answer
2k views

Why not use OAEP for signatures?

There seems to be a distinct lack of implementations of RSA signatures using OAEP to pad the digest. Other than the old, funky, padding schemes, it's PSS all the way. PSS seems to have the whiff of ...
4
votes
1answer
387 views

Secure ElGamal with OAEP

Is it possible to make ElGamal IND-CCA2 using OAEP or OAEP+? (OAEP+ from: "OAEP Reconsiderd" by Shoup) The reason I ask is that I recently answered this question and it came to my mind that OAEP or ...
1
vote
0answers
55 views

Is RSA-OAEP secure when e=3? [duplicate]

Is RSA-OAEP secure when the exponent is equal to 3?
1
vote
1answer
2k views

Strength of RSA with OAEP

In our current system we use an encryption solution based on RSA with OAEP padding. Key size is optional but default 2048. What is the general strength of RSA with OAEP? Are there know attacks that ...
2
votes
0answers
330 views

Defending hybrid encryption schemes against padding oracle attacks

I intend to use a generic integrated/hybrid encryption scheme for transmitting information between a client and a server. Key encapsulation: a 128-bit symmetric key is generated and asymmetrically ...
-2
votes
2answers
715 views

Selection of cryptographic functions for OAEP

I can't understand how the "cryptographic functions" are to be selected RSA + OAEP which are used in OAEP. How to choose these "cryptographic functions"(G and H)?
5
votes
1answer
6k views

Questions about OAEP for RSA

I have two questions about OAEP for RSA. How are the number of bits to pad with 0 chosen? For example, if I'm sending a 255 byte message with RSA-2048 I have 8 unused bits (1 byte). Should I split ...
2
votes
0answers
132 views

partial-domain permutation and strong assumption

Quoting "Verified Security of Redundancy-Free Encryption from Rabin and RSA", Chapter 2 (on page 4): OAEP was proved IND-CCA-secure by Fujisaki et al. [28] under the assumption that the underlying ...
2
votes
1answer
2k views

How does OAEP improve the security of RSA?

The heart of OAEP algorithm used for RSA encryption are the cryptographic hash functions $H$ and $G$. Does everybody (so also an adversary) know these functions? If YES: How does it help the ...