Cryptology Academy · Lesson

OAEP: Optimal Asymmetric Encryption Padding

Walk through OAEP encoding and how it achieves IND-CCA2 security.

Lesson 3 of 413 steps

OAEP: Optimal Asymmetric Encryption Padding is a free Cryptology Academy lesson on CoddyKit. This is lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cryptology Academy learning path, and your progress syncs across the web and the CoddyKit app. The Cryptology Academy course includes 4 lessons in total.

Welcome

OAEP (Optimal Asymmetric Encryption Padding) provides provably IND-CCA2 secure RSA encryption. It uses randomized encoding that makes oracle queries cryptographically worthless.

OAEP Goals

OAEP was designed by Bellare and Rogaway (1994) with two goals: (1) prevent all textbook RSA attacks via randomization, (2) achieve IND-CCA2 security with a formal security proof in the random oracle model.

OAEP Inputs

M: message to encrypt (|M| ≤ |n| - 2*hLen - 2 bytes) L: optional label (usually empty) MGF: Mask Generation Function (based on SHA-256) r: random seed (hLen bytes)

OAEP Encoding Step 1: Data Block

DB = lHash || PS || 0x01 || M where: - lHash = Hash(L) (hash of the label) - PS = zero bytes filling to fixed length - 0x01 marks the start of the message

OAEP Encoding Step 2: Masking

maskedDB = DB XOR MGF(r, len(DB)) maskedSeed = r XOR MGF(maskedDB, hLen) EM = 0x00 || maskedSeed || maskedDB This is the padded message fed to RSA encryption.

MGF1: Mask Generation Function

MGF1(Z, L) = Hash(Z || 0x00000000) || Hash(Z || 0x00000001) || ... MGF1 with SHA-256 generates arbitrary-length pseudorandom output from a seed. Used in OAEP and RSA-PSS.

OAEP Decoding

Given EM: 1. Split into maskedSeed and maskedDB 2. r = maskedSeed XOR MGF(maskedDB, hLen) 3. DB = maskedDB XOR MGF(r, len(DB)) 4. Verify lHash matches; find 0x01 separator; extract M 5. Any error → decryption failed (same error always)

Why OAEP Defeats Oracle Attacks

OAEP's random seed r changes with every encryption. A modified ciphertext decrypts to a uniformly random padded message with overwhelming probability. The oracle sees 'invalid' for all modifications.

IND-CCA2 Security

IND-CCA2 (Indistinguishability under Chosen-Ciphertext Attack 2): attacker cannot distinguish Enc(M0) from Enc(M1) even with access to a decryption oracle for all ciphertexts except the challenge. OAEP achieves this.

OAEP vs v1.5 in Practice

Python cryptography library: use padding.OAEP(), not padding.PKCS1v15(). Java: use 'RSA/ECB/OAEPWithSHA-256AndMGF1Padding' cipher. Never use 'RSA/ECB/PKCS1Padding' for new code.

OAEP Maximum Message Size

For RSA-2048 with SHA-256: Max message = 256 - 2×32 - 2 = 190 bytes OAEP's overhead is 2×hLen + 2 bytes. For longer messages, use AES hybrid encryption: encrypt AES key with OAEP, data with AES-GCM.

Quick Check

What property makes OAEP resistant to padding oracle attacks?

Answer it in the interactive lesson

Recap

OAEP provides provable security for RSA encryption. Next we study RSA-PSS — the analogous improvement for RSA signatures.

Free to start

Learn Cryptology Academy with an AI tutor — free

Write and run real code in your browser, get instant help from a 24/7 AI tutor, and pick up where you left off on the web or in the app.

Courses: 67
Lessons: 261

Start learning free View the full course

Frequently Asked Questions

Is the “OAEP: Optimal Asymmetric Encryption Padding” lesson free?

Yes — the full text of “OAEP: Optimal Asymmetric Encryption Padding” is free to read here on the web. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cryptology Academy course, upgrade to CoddyKit PRO. The Cryptology Academy course includes 4 lessons in total.

What will I learn in “OAEP: Optimal Asymmetric Encryption Padding”?

Walk through OAEP encoding and how it achieves IND-CCA2 security. You practise Cryptology Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cryptology Academy?

No prior experience is required. Cryptology Academy on CoddyKit is structured for beginners through advanced learners, so you can start here or from the beginning and move at your own pace. This is lesson 3 of 4.

How long does the “OAEP: Optimal Asymmetric Encryption Padding” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cryptology Academy lesson?

Yes. Every Cryptology Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

Textbook RSA & Why It Is Insecure
PKCS#1 v1.5 Padding & Bleichenbacher
OAEP: Optimal Asymmetric Encryption Padding
RSA-PSS for Digital Signatures

← Back to Cryptology Academy