RSAES-PKCS1-v1_5 is the RSA encryption scheme that adds reversible, random padding before encryption. The padding defeats simple brute-force guesses against small messages, but the scheme remains vulnerable to adaptive padding-oracle attacks. section 6.3.2
Its basic encryption story is:
- Start with a message such as m = 2. section 6.3.2
- Add nondeterministic random bytes so the encoded message is larger and repeated plaintexts do not produce predictable ciphertexts. section 6.3.2
- Encrypt the padded message with RSA, then remove the padding after decryption. section 6.3.2
The improvement over textbook RSA is not a complete security guarantee. In 1998, Bleichenbacher demonstrated a practical million-message attack: an attacker submits chosen ciphertexts, observes decryption behavior, and adapts later submissions to recover plaintext. This is an adaptive chosen-ciphertext attack, commonly called a padding-oracle attack. section 6.3.2
PKCS#1 v1.5 also defines an RSA signature scheme, officially distinguished as RSASSA-PKCS1-v1_5; RSAES-PKCS1-v1_5 is the encryption name. For encryption, prefer the later RSA-OAEP construction rather than deploying this legacy scheme. section 7.3.1 section 7.5
Figure 6.14 The RSA PKCS#1 v1.5 standard specifies a padding to apply to a message prior to encryption. The padding must be reversible (so that decryption can get rid of it) and must add enough random bytes to the message in order to avoid brute force attacks.
Padding layout makes the scheme's original goal visible: preserve reversibility while adding enough random bytes to prevent simple brute-force matching. section 6.3.2
