Padding (PKCS#1 v1.5 vs OAEP)

Textbook RSA (m^e mod n on raw plaintext) is INSECURE:

• Encrypting the same m always gives the same c → attackers learn message identity.
• Small m and e=3: c = m^3 is easy to invert if m^3 < n.
• Many other attacks based on RSA's deterministic algebraic structure.

Padding adds randomness:

PKCS#1 v1.5 (1993): pad with a random byte string + 0x00 separator + message.

EM = 0x00 || 0x02 || PS || 0x00 || M
   where PS is at least 8 bytes of random non-zero bytes

Vulnerable to Bleichenbacher's attack (1998) — adaptive chosen-ciphertext attack. Modern systems STILL find this in misconfigured TLS implementations (ROBOT attack, 2017).

OAEP (Optimal Asymmetric Encryption Padding, 1995): mathematically robust randomized padding.

        +---+
        |M|0|
        +---+
            |
        XOR with MGF(seed)
            |
        +---+
        |DB |
        +---+
            |
   +-+-XOR-+
   | seed' |
   +-------+

OAEP is the modern recommendation for RSA encryption. Use OAEP-SHA256 or OAEP-SHA512.

For SIGNING, PKCS#1 v1.5 is still common (less attack surface than encryption padding) but PSS (Probabilistic Signature Scheme) is preferred. PSS is mandatory in TLS 1.3.