Skip to main content
34 votes

What is the maximum size of the plaintext message for RSA OAEP?

Important note: usually OAEP is only used to encrypt a random symmetric key, which is then used to encrypt a plaintext message; this is called a hybrid cryptosystem. Repeated use of OAEP would require ...
Maarten Bodewes's user avatar
  • 93.2k
22 votes

Is RSA-OAEP deprecated?

RSA in general is often considered to be "discouraged" for new projects. For quite some years, the rallying cry has been "switch to elliptic curves", but nowadays there are calls ...
Thomas Pornin's user avatar
17 votes
Accepted

What's the point of OAEP?

Do we consider RSA+OAEP secure because the number of possible padded representations of a message is some insanely large number, and thus not feasible to bruteforce with current hardware? No. But a ...
fgrieu's user avatar
  • 142k
10 votes

What is the reason for length differences in RSA?

Three reasons: Technical: often the integrity and origin of a piece of data becomes immaterial after the data is acted upon; and for long-term use (e.g. document signing), if the security of the ...
fgrieu's user avatar
  • 142k
9 votes

Is RSA-OAEP deprecated?

You'll have to ask the author of that site why they made that assessment. Although there's no technical reason to prefer RSA-OAEP over the much simpler (to implement and to study) RSA-KEM, RSA-OAEP is ...
Squeamish Ossifrage's user avatar
7 votes
Accepted

What are the uses of arbitrary length output hashes (other than OAEP)?

Uses for SHAKE/XOF functions Community wiki answer, please add and edit: key derivation of any type such as turning a 128-256 bit secret key into an ECC or RSA public/private key pair deterministic ...
7 votes

Is Bouncycastle RSA+OAEP implementation vulnerable to Manger’s attack?

Bouncy Castle Java releases 1.60 and FIPS 1.0.1 (and former) have precisely the issue exploited in Manger's attack: an exception occurs when a ciphertext $c$ is submitted such that $c^d\bmod N$, ...
fgrieu's user avatar
  • 142k
7 votes
Accepted

Is there an easy way to make textbook RSA secure enough so it can be used in real life?

Actually, RSASSA-PKCS1-v1_5 signature padding is quite simple, and has no known weaknesses (the similarly named RSAES-PKCS1-v1_5 padding is broken for encryption unless implemented in a very very ...
poncho's user avatar
  • 148k
6 votes
Accepted

Should we use exponent 3 in RSA-OAEP?

For any reasonable RSA-based encryption (or signature) scheme, exponent $e = 3$ is a perfectly good choice and provides the best performance for the public-key operation short of qualitatively ...
Squeamish Ossifrage's user avatar
6 votes
Accepted

Why did OAEP change from PKCS#1 v2.0 and v2.1?

The answer is relatively simple, but I'll expand on the details of the changes from PKCS#1 2.0 to 2.1 in two additional sections below this answer. On the padding with the zero valued byte The I2OSP ...
Maarten Bodewes's user avatar
  • 93.2k
6 votes

If OAEP is introducing randomness to encryption how could be ciphertext decrypted?

To decrypt the ciphertext you definitely need to recover the random token $r$. But $r = Y \oplus H(X)$. Then knowing $r$ the padded message can be recovered as $m0\dots0 = X \oplus G(r)$. The ...
ddddavidee's user avatar
  • 3,344
6 votes
Accepted

RSA-OAEP Padding scheme

Direct use of textbook RSA for encryption is very insecure. For example, a guess of the plaintext can be checked: if what's encrypted is a name on the class roll, enciphering all names on the class ...
fgrieu's user avatar
  • 142k
6 votes

Is there an easy way to make textbook RSA secure enough so it can be used in real life?

There is also a more simple but not well-known signature scheme for RSA; RSA Full Domain Hash It has existentially unforgeable under adaptive chosen-message attacks in the random oracle model. ...
kelalaka's user avatar
  • 48.9k
5 votes
Accepted

Preferred SHA-2 hash algorithm for MGF1 in RSA

Since the input sizes are fixed, length-extension attacks are not relevant, so any of the SHA-2 functions reasonably implements the random oracle model assumed by OAEP or PSS via MGF1—even the default ...
Squeamish Ossifrage's user avatar
5 votes

If OAEP is introducing randomness to encryption how could be ciphertext decrypted?

You are right that in decryption we need to know the value of $r$, but this can be easily recovered from the ciphertext alone, in fact, $r = Y \oplus H(X)$ and both $X,Y,H$ are known. Then the message ...
Ruggero's user avatar
  • 7,104
4 votes

Is OAEP reversible?

If you know the hash functions, yes. If the hash functions are secret, no—but how would you come into a situation where OAEP is being used with a secret hash function? For any hash functions $G$ and ...
Squeamish Ossifrage's user avatar
4 votes
Accepted

Use of OAEP in RSA Encryption

Is this step necessary? Yes. Assuming you don't want to adopt a RSA-KEM based approach, you need some form of padding to gain full IND-CCA2 security (textbook RSA even lacks the much weaker IND-CPA ...
SEJPM's user avatar
  • 46.1k
4 votes
Accepted

Role of lHash field in RSAES-OAEP

I believe $\mathit{lHash} \mathbin\Vert \mathit{PS} \mathbin\Vert \mathrm{01}$ serves the rôle of the zero-padding in $s = (m \mathbin\Vert 0^{k_1}) \oplus G(r)$ from the formulation of RSAES-OAEP in ...
Squeamish Ossifrage's user avatar
4 votes
Accepted

OAEP Cryptanalysis

No, knowledge of $\operatorname{OAEP}(M_1)\oplus\operatorname{OAEP}(M_2)$ does not disclose information about plaintexts $M_1$ or $M_2$. In particular it does not allow to recover either, even with ...
fgrieu's user avatar
  • 142k
4 votes

Security of RSA-KEM against cube root attack

Q1: The random selection should be $\sqrt[3]{n}<m<n$ due to cube-root attack? Suppose $n$ is 2048 bits long. Then $\sqrt[3] n < 2^{700}$. If $m$ is uniformly distributed in $\{1, 2, \dots, ...
Squeamish Ossifrage's user avatar
4 votes
Accepted

RSA Signing: SHA512 incompatible with PSS?

Yes, this is expected, if the RSASSA-PSS signing code/test uses salt the width of the hash, which is customary. In that case, a $h$-bit hash (with $h$ multiple of 8) requires an RSA public modulus at ...
fgrieu's user avatar
  • 142k
3 votes
Accepted

In PKCS#1 V2.2, should MGF be based on the same hash function that RSA-OAEP-ENCRYPT uses?

The first hash is only used to hash the label. Most of the time the label will simply be empty, which means that a constant value can be used, identified just by the hash algorithm itself. Although ...
Maarten Bodewes's user avatar
  • 93.2k
3 votes

Why is padding the plaintext with a random string before encryption worse than OAEP / PKCS#7?

The padding used for RSA is not the PKCS #5/#7 padding (as you seem to suggest in your own answer), but the Wikipedia entry seems to refer to PKCS #1 v1.5 (RFC2313)) which uses a padding ...
Henno Brandsma's user avatar
3 votes
Accepted

Security effects of the seed's length in OAEP

Let's start with the preliminaries. The basic scheme has encryption defined as follows: $$\mathcal{E}^{G, H}(x) = f(x \oplus G(r) || r \oplus H(x \oplus G(r)))$$ Some definitions: $f: \{0,1\}^k \...
puzzlepalace's user avatar
  • 4,042
3 votes

Distinguish between cipher-texts of text-book RSA and RSA/OAEP

We can distinguish between ciphertext of textbook RSA and RSA/OAEP when textbook RSA is misused and insecure; or with knowledge of the private key. With knowledge of the private key, we simply ...
fgrieu's user avatar
  • 142k
3 votes

Is RSA-OAEP deprecated?

The table that you cite should not be considered authoritative. There is nothing wrong with using RSA-OAEP. It is a well-studied protocol based on RSA primitives and more than twenty years of ...
vy32's user avatar
  • 439
3 votes

Probabilistic padding to avoid Håstad’s Broadcast Attack

If you use the same padding on the same messages, sent to multiple different public keys, then you have satisfied the criteria of the Håstad attack. Randomizing the padding as in OAEP means that you ...
Squeamish Ossifrage's user avatar
3 votes
Accepted

OAEP security with variable length hash function

Beware that if $n < m$, then $\operatorname{SHAKE256-}\!n(x)$ is a prefix of $\operatorname{SHAKE256-}\!m(x)$, so the two functions are not really independent random oracles as the usual OAEP ...
Squeamish Ossifrage's user avatar
3 votes
Accepted

Is OAEP needed when encrypting a session (random) key using RSA?

when encrypting a session key which is used to encrypt bulk data using a block cipher for example, is padding with OAEP really needed ? No if the session key is nearly as wide as the RSA modulus, or ...
fgrieu's user avatar
  • 142k
3 votes

JWE between Android/iPhone and backend

node-jose only supports RSA OAEP with SHA-1 and no MGF1 or RSA OAEP with SHA-256 and no MGF1 That's extremely unlikely since OAEP does need to use a Mask Generation Function, and there is only one ...
Maarten Bodewes's user avatar
  • 93.2k

Only top scored, non community-wiki answers of a minimum length are eligible