Optimal asymmetric encryption padding

In <a href="/facts/Cryptography/e94PEVau">cryptography</a>, Optimal Asymmetric Encryption Padding (OAEP) is a <a href="/facts/Padding_(cryptography)/okxl18q9">padding scheme</a> often used together with <a href="/facts/RSA_(cryptosystem)/XTzyfHuq">RSA encryption</a>. OAEP was introduced by <a href="/facts/Mihir_Bellare/uRjcPYqu">Bellare</a> and <a href="/facts/Phillip_Rogaway/hYhbH8V5">Rogaway</a>, and subsequently standardized in <a href="/facts/PKCS1/I6JD53RG">PKCS#1 v2</a> and RFC 2437.
The OAEP algorithm is a form of <a href="/facts/Feistel_network/CPtzaEET">Feistel network</a> which uses a pair of <a href="/facts/Random_oracle/wK7MhxDq">random oracles</a> G and H to process the plaintext prior to <a href="/facts/Asymmetric_encryption/gowoFTxS">asymmetric encryption</a>. When combined with any secure <a href="/facts/Trapdoor_one-way_function/xMTTRrhY">trapdoor one-way permutation</a> 
 
 
 
 f
 
 
 {\displaystyle f}
 
, this processing is proved in the <a href="/facts/Random_oracle_model/wK7MhxDq">random oracle model</a> to result in a combined scheme which is <a href="/facts/Semantic_security/PlW18aEh">semantically secure</a> under <a href="/facts/Chosen_plaintext_attack/uTJ0XCAN">chosen plaintext attack</a> <a href="/facts/Ciphertext_indistinguishability/2oumAzNt">(IND-CPA)</a>. When implemented with certain trapdoor permutations (e.g., RSA), OAEP is also proven to be secure against <a href="/facts/Chosen_ciphertext_attack/l9fL7fYR">chosen ciphertext attack</a>. OAEP can be used to build an <a href="/facts/All-or-nothing_transform/1tUzEuQ9">all-or-nothing transform</a>.
OAEP satisfies the following two goals:

<ol><li>Add an element of randomness which can be used to convert a <a href="/facts/Deterministic_encryption/UDDXRtQ2">deterministic encryption</a> scheme (e.g., traditional <a href="/facts/RSA_(algorithm)/XTzyfHuq">RSA</a>) into a <a href="/facts/Probabilistic_encryption/a52EXNPD">probabilistic</a> scheme.</li>
<li>Prevent partial decryption of ciphertexts (or other information leakage) by ensuring that an adversary cannot recover any portion of the plaintext without being able to invert the <a href="/facts/Trapdoor_one-way_function/xMTTRrhY">trapdoor one-way permutation</a> 
 
 
 
 f
 
 
 {\displaystyle f}
 
.</li></ol>
The original version of OAEP (Bellare/Rogaway, 1994) showed a form of "<a href="/facts/Plaintext-aware_encryption/KQBI2Wuu">plaintext awareness</a>" (which they claimed implies security against <a href="/facts/Chosen_ciphertext_attack/l9fL7fYR">chosen ciphertext attack</a>) in the random oracle model when OAEP is used with any trapdoor permutation. Subsequent results contradicted this claim, showing that OAEP was only <a href="/facts/Ciphertext_indistinguishability/2oumAzNt">IND-CCA1</a> secure. However, the original scheme was proved in the <a href="/facts/Random_oracle_model/wK7MhxDq">random oracle model</a> to be <a href="/facts/Ciphertext_indistinguishability/2oumAzNt">IND-CCA2</a> secure when OAEP is used with the RSA permutation using standard encryption exponents, as in the case of RSA-OAEP.
An improved scheme (called OAEP+) that works with any trapdoor one-way permutation was offered by <a href="/facts/Victor_Shoup/QVWxQhUG">Victor Shoup</a> to solve this problem.
More recent work has shown that in the <a href="/facts/Standard_Model_(cryptography)/pjCTKoKe">standard model</a> (that is, when hash functions are not modeled as random oracles) it is impossible to prove the IND-CCA2 security of RSA-OAEP under the assumed hardness of the <a href="/facts/RSA_problem/UykpazBr">RSA problem</a>.

Optimal asymmetric encryption padding open-in-new

Optimal asymmetric encryption padding