OAEP

OAEP, or Optimal Asymmetric Encryption Padding, is a padding scheme used with RSA public-key encryption to provide semantic security. It was introduced by Bellare and Rogaway in 1994 and standardized in PKCS #1 and ISO/IEC 18033. OAEP combines a hash function, a mask generation function, and randomization to produce randomized ciphertexts and to harden RSA against certain attacks. It is commonly used with RSA encryption and can be parameterized with different hash algorithms.

In OAEP, the message M is padded into a fixed-length data block, DB, together with a random seed. Let k be the RSA modulus length in octets, hLen the output length of the hash, and L an optional label. Compute lHash = Hash(L). Form DB = lHash || PS || 0x01 || M, where PS is a string of zeroes to reach length k - hLen - 1. Draw a random seed of length hLen. Compute dbMask = MGF(seed, k - hLen - 1) and maskedDB = DB XOR dbMask. Compute seedMask = MGF(maskedDB, hLen) and maskedSeed = seed XOR seedMask. The encoded message EM is 0x00 || maskedSeed || maskedDB. The RSA encryption then operates on EM to produce the ciphertext.

Decryption reverses the process to recover EM, extract M after unpadding, and verify the label. OAEP's security relies on the pseudorandomness of the mask generation function and the randomness of the seed; when correctly implemented, RSA-OAEP provides IND-CPA security under standard assumptions and is widely recommended over older PKCS #1 v1.5 padding. Common hash choices include SHA-1, SHA-256, or SHA-3, with modern deployments favoring SHA-256 or SHA-384; the MGF1 construction is defined in PKCS #1 and related standards.