Padding (PKCS#1 v1.5 vs OAEP)

Textbook RSA (m^e mod n on raw plaintext) is INSECURE:

• Encrypting the same m always gives the same c → attackers learn message identity.
• Small m and e=3: c = m^3 is easy to invert if m^3 < n.
• Many other attacks based on RSA's deterministic algebraic structure.

Padding adds randomness:

PKCS#1 v1.5 (1993): pad with a random byte string + 0x00 separator + message.

EM = 0x00 || 0x02 || PS || 0x00 || M
   where PS is at least 8 bytes of random non-zero bytes

Vulnerable to Bleichenbacher's attack (1998) — adaptive chosen-ciphertext attack. Modern systems STILL find this in misconfigured TLS implementations (ROBOT attack, 2017).

OAEP (Optimal Asymmetric Encryption Padding, 1995): mathematically robust randomized padding. Rather than prepending random bytes, it masks the whole block twice with a hash-derived keystream:

DB         = lHash || 00...00 || 01 || M
maskedDB   = DB   XOR MGF1(seed,     k - hLen - 1)
maskedSeed = seed XOR MGF1(maskedDB, hLen)
EM         = 00 || maskedSeed || maskedDB

The seed is fresh per encryption, so the same M never encodes the same way twice, and flipping any single bit of EM randomises the entire recovered DB. That is what removes the partial-validity signal Bleichenbacher's attack climbs -- there is no longer a "the first two bytes were right" to leak. The OAEP lesson builds this byte for byte.

OAEP is the modern recommendation for RSA encryption. Use OAEP-SHA256 or OAEP-SHA512.

For SIGNING, PKCS#1 v1.5 is still common (less attack surface than encryption padding) but PSS (Probabilistic Signature Scheme) is preferred. PSS is mandatory in TLS 1.3.