RSAES-PKCS1-v1_5 is an older RSA encryption scheme that applies PKCS #1 version 1.5 padding before encrypting a message. Although widely adopted, it is considered insecure because it is vulnerable to chosen-ciphertext attacks. Modern applications should use RSA-OAEP instead. section 6.3.1 section 6.6
The main practical risk is legacy compatibility. Older systems may still support PKCS #1 v1.5, allowing downgrade attacks that pressure a connection into using the weaker scheme. Applications should reject RSAES-PKCS1-v1_5 rather than silently accepting it. section 6.3.1
When configuring RSA encryption, distinguish the following choices:
- Key size controls the RSA key length; 2,048-bit keys are considered secure today, while 3,072- or 4,096-bit keys are recommended for longer-term security. section 6.3.1
- Padding protects plaintext before encryption. Prefer RSA-OAEP, which uses randomized padding and provides stronger security guarantees. section 6.3.1 section 6.5
- For large data, use hybrid encryption: encrypt the content with AES and use RSA to encrypt, or wrap, the AES key. section 6.5 section 6.6
Legacy API compatibility
An API that accepts both RSA-OAEP and RSAES-PKCS1-v1_5 may be downgraded to the older scheme. Configure the application to reject PKCS #1 v1.5 and require the stronger alternative. section 6.3.1
