Archivecryptography
RSA Without Proper Padding Is Broken
Textbook RSA is multiplicative; PKCS#1 v1.5 is fragile; OAEP is the floor for encryption.
- Published
- Reading time
- 1 min read
RSA encryption is c = m^e mod n. That operation is multiplicatively homomorphic: E(a) * E(b) = E(a*b). Without padding, an attacker can manipulate ciphertexts, and small-message attacks recover m by taking integer roots.
Padding schemes
- PKCS#1 v1.5: randomized but vulnerable to Bleichenbacher-style padding oracles wherever the receiver reveals whether decryption failed. Still common in old TLS.
- OAEP: includes a hash-based Feistel structure with a label, designed to resist chosen-ciphertext attacks. This is the minimum for new encryption.
- PSS: the signature counterpart; randomized and provably secure in the random-oracle model.
Better answers
RSA encryption is increasingly replaceable: use ECDH/X25519 for key agreement or HPKE for hybrid encryption. RSA still has a place in signatures for compatibility and in some regulated environments, with PSS and 3072+ bit keys.
Takeaway: never call raw RSA. If you must, OAEP for encryption and PSS for signatures — and treat any "invalid padding" error message as an oracle.