RSA-OAEP is a randomized padding scheme for RSA encryption. It mixes a message with random data using hash functions, reducing structural leakage and providing stronger protection against chosen-ciphertext attacks than older RSAES-PKCS1-v1_5 padding. section 6.3.1 section 6.6
Choose RSA-OAEP when configuring RSA encryption:
- Prefer RSA-OAEP over RSAES-PKCS1-v1_5, which is older, weaker, and vulnerable to chosen-ciphertext attacks. section 6.3.1 section 6.5
- Reject PKCS#1 v1.5 where possible so compatibility does not create a downgrade path to a less secure scheme. section 6.3.1
- Use RSA keys of at least 2,048 bits; 3,072- or 4,096-bit keys are recommended for longer-term security. section 6.3.1 section 6.5
RSA-OAEP in hybrid encryption
Encrypt large content with a fast AES key, then wrap that content-encryption key with the recipient’s RSA public key using RSA-OAEP. The recipient uses the RSA private key to unwrap the AES key and decrypt the content. TLS, IPsec, JWE, and SSH use hybrid encryption patterns. section 6.3.2 section 6.5
Figure 6.5 Hybrid encryption uses a high-performance symmetric algorithm such as AES to encrypt content. Then the AES CEK is encrypted with the recipient’s RSA public key, allowing the recipient to use their private key to first the CEK and then decrypt the content.
Trace the two-stage flow: AES encrypts the content, while RSA-OAEP encrypts the AES content-encryption key for the recipient. section 6.3.2
