RSAOAEP

RSAES-OAEP, or RSA Encryption with Optimal Asymmetric Encryption Padding, is a padding scheme used with RSA to achieve probabilistic, semantically secure encryption. It was designed to prevent padding oracle and related attacks that can affect RSA when simple padding or raw RSA is used. The scheme is defined in PKCS #1 and standardized in RFC 8017.

OAEP uses a pair of hash-based functions: a hash function H and a mask generation function MGF1 derived from H. To encrypt, the message M, together with an optional label L, is incorporated into a data block DB. A random seed S is generated and used to mask DB; DB in turn masks S. The resulting encoded message EM, which has the same length as the RSA modulus, is then exponentiated with the recipient’s public key to produce the ciphertext. Decryption reverses the steps to recover M. The label L, if present, binds additional context to the message and should be agreed by sender and recipient.

Security the scheme aims to provide semantic security for RSA encryption under standard hardness assumptions, in the random oracle model. Its security hinges on the unpredictability of the random seed and the one-wayness of RSA, with a modern hash function and proper randomness being important for safety.

Standards and usage: RSAES-OAEP is part of PKCS#1 v2.x and widely implemented with SHA-256 or SHA-3 families. It is used in protocols such as TLS and S/MIME for encrypting keys or small data blobs, typically as a precursor to symmetric encryption rather than for bulk data.

Implementation notes: adhere to RFC 8017, use a secure RNG for the seed, and select a sufficient modulus size (commonly at least 2048 bits). Ensure correct handling of the optional label and MGF1.