DataTerminology.comNEW
Also known as: RSA Optimal Asymmetric Encryption Padding
An RSA encryption scheme that uses Optimal Asymmetric Encryption Padding to produce randomized, semantically secure ciphertexts.
DESCRIPTION
RSA-OAEP is a modern padding-based RSA encryption scheme defined in PKCS #1 (RFC 8017). OAEP adds randomness via a mask generation function and hash, achieving semantic security against chosen-plaintext attacks. It is widely used in hybrid encryption to protect symmetric keys in TLS and PKI systems. Correct parameter selection (hash, MGF1) and decryption error handling are essential for security. RSAES-PKCS1-v1_5 is considered legacy compared to RSA-OAEP.
ALTERNATIVE DEFINITIONS
IETF RFC 8017 (PKCS #1 v2.2)
RSAES-OAEP: RSA Encryption Scheme - Optimal Asymmetric Encryption Padding.
Normative specification title defining the OAEP-based RSA encryption scheme.
Wikipedia
Optimal Asymmetric Encryption Padding (OAEP) is a padding scheme often used together with RSA encryption.
Short encyclopedic definition linking OAEP to RSA usage.
NIST
The RSAES-OAEP scheme specified in PKCS #1 may be used for the encryption of data in a KTS when RSA is employed.
NIST guidance contextualizing OAEP within key transport schemes.
RELATED TERMS
RSA PKCS #1 Asymmetric Encryption Padding Semantic Security Hybrid Encryption MGF1 SHA-256 NIST SP 800-56B Key Encapsulation Mechanism
COMPETING TERMS
RSAES-PKCS1-v1_5
KNOWLEDGE AREAS
Data Security Data Privacy & Compliance Infrastructure
TARGET AUDIENCE
Security Architect Cybersecurity Engineer Chief Information Security Officer Software Developer Data Privacy Officer IT Auditor
EXTERNAL SOURCES
- Wikipedia - Optimal asymmetric encryption padding
- IETF - PKCS #1 v2.2 standard for RSA
- NIST - Recommendations for key transport using RSA
TOP QUESTIONS
Why is RSA-OAEP preferred over RSAES-PKCS1-v1_5?
OAEP provides semantic security with randomness and stronger theoretical guarantees, whereas v1_5 has historical vulnerabilities.
Category: Opinion
What parameters matter in RSA-OAEP?
Hash function and MGF1 choice must align with security requirements; consistent parameters are required for interoperability.
Category: Requirements
Where is RSA-OAEP commonly used?
In hybrid encryption for transporting symmetric keys within TLS, PKI, and secure messaging systems.
Category: Overview
What are common implementation mistakes with RSA-OAEP?
Using mismatched hash/MGF settings, leaking padding oracle information via error messages, and failure to validate ciphertext lengths.
Category: Mistakes
What risks arise with RSA-OAEP deployments?
Incorrect padding error handling can enable oracle attacks; weak keys or poor RNG also undermine security.
Category: Risks
How does RSA-OAEP achieve semantic security?
OAEP introduces randomness via masking and hashing, ensuring ciphertexts reveal no information about plaintexts.
Category: Example
Is RSA-OAEP quantum-safe?
No; RSA is vulnerable to quantum attacks. Post-quantum KEMs are recommended for long-term security.
Category: Opinion
How should errors be handled in RSA-OAEP decryption?
Use constant-time checks and generic error messages to avoid information leaks about padding or plaintext validity.
Category: Best practices
What standards specify RSA-OAEP?
PKCS #1 (RFC 8017) and NIST SP 800-56B provide normative specifications and guidance.
Category: Overview