Search results
Results From The WOW.Com Content Network
In cryptography, Optimal Asymmetric Encryption Padding (OAEP) is a padding scheme often used together with RSA encryption.OAEP was introduced by Bellare and Rogaway, [1] and subsequently standardized in PKCS#1 v2 and RFC 2437.
RSA padding schemes must be carefully designed so as to prevent sophisticated attacks that may be facilitated by a predictable message structure. Early versions of the PKCS#1 standard (up to version 1.5) used a construction that appears to make RSA semantically secure.
In cryptography, padding is any of a number of distinct practices which all include adding data to the beginning, middle, or end of a message prior to encryption. In classical cryptography, padding may include adding nonsense phrases to a message to obscure the fact that many messages end in predictable ways, e.g. sincerely yours.
However, the vulnerable padding scheme remains in use and has resulted in subsequent attacks: Bardou et al. (2012) find that several models of PKCS 11 tokens still use the v1.5 padding scheme for RSA. They propose an improved version of Bleichenbacher's attack that requires fewer messages.
PKCS Standards Summary; Version Name Comments PKCS #1: 2.2: RSA Cryptography Standard [1]: See RFC 8017. Defines the mathematical properties and format of RSA public and private keys (ASN.1-encoded in clear-text), and the basic algorithms and encoding/padding schemes for performing RSA encryption, decryption, and producing and verifying signatures.
IFES (Integer Factorization Encryption Scheme): Essentially RSA encryption with Optimal Asymmetric Encryption Padding (OAEP). DL/ECIES (Discrete Logarithm/Elliptic Curve Integrated Encryption Scheme): Essentially the "DHAES" variant of ElGamal encryption. IFES-EPOC (Integer Factorization Encryption Scheme, EPOC version)
In addition to the RSA problem, RSA also has a particular mathematical structure that can potentially be exploited without solving the RSA problem directly. To achieve the full strength of the RSA problem, an RSA-based cryptosystem must also use a padding scheme like OAEP, to protect against such structural problems in RSA.
Several padding schemes exist. The simplest is to add null bytes to the plaintext to bring its length up to a multiple of the block size, but care must be taken that the original length of the plaintext can be recovered; this is trivial, for example, if the plaintext is a C style string which contains no null bytes except at the end.