0Pricing
Cryptology Academy · Lesson

OAEP: Optimal Asymmetric Encryption Padding

Walk through OAEP encoding and how it achieves IND-CCA2 security.

OAEP: Optimal Asymmetric Encryption Padding is a free Cryptology Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cryptology Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Welcome

OAEP (Optimal Asymmetric Encryption Padding) provides provably IND-CCA2 secure RSA encryption. It uses randomized encoding that makes oracle queries cryptographically worthless.

OAEP Goals

OAEP was designed by Bellare and Rogaway (1994) with two goals: (1) prevent all textbook RSA attacks via randomization, (2) achieve IND-CCA2 security with a formal security proof in the random oracle model.

OAEP Inputs

M: message to encrypt (|M| ≤ |n| - 2*hLen - 2 bytes) L: optional label (usually empty) MGF: Mask Generation Function (based on SHA-256) r: random seed (hLen bytes)

OAEP Encoding Step 1: Data Block

DB = lHash || PS || 0x01 || M where: - lHash = Hash(L) (hash of the label) - PS = zero bytes filling to fixed length - 0x01 marks the start of the message

OAEP Encoding Step 2: Masking

maskedDB = DB XOR MGF(r, len(DB)) maskedSeed = r XOR MGF(maskedDB, hLen) EM = 0x00 || maskedSeed || maskedDB This is the padded message fed to RSA encryption.

MGF1: Mask Generation Function

MGF1(Z, L) = Hash(Z || 0x00000000) || Hash(Z || 0x00000001) || ... MGF1 with SHA-256 generates arbitrary-length pseudorandom output from a seed. Used in OAEP and RSA-PSS.

OAEP Decoding

Given EM: 1. Split into maskedSeed and maskedDB 2. r = maskedSeed XOR MGF(maskedDB, hLen) 3. DB = maskedDB XOR MGF(r, len(DB)) 4. Verify lHash matches; find 0x01 separator; extract M 5. Any error → decryption failed (same error always)

Why OAEP Defeats Oracle Attacks

OAEP's random seed r changes with every encryption. A modified ciphertext decrypts to a uniformly random padded message with overwhelming probability. The oracle sees 'invalid' for all modifications.

IND-CCA2 Security

IND-CCA2 (Indistinguishability under Chosen-Ciphertext Attack 2): attacker cannot distinguish Enc(M0) from Enc(M1) even with access to a decryption oracle for all ciphertexts except the challenge. OAEP achieves this.

OAEP vs v1.5 in Practice

Python cryptography library: use padding.OAEP(), not padding.PKCS1v15(). Java: use 'RSA/ECB/OAEPWithSHA-256AndMGF1Padding' cipher. Never use 'RSA/ECB/PKCS1Padding' for new code.

OAEP Maximum Message Size

For RSA-2048 with SHA-256: Max message = 256 - 2×32 - 2 = 190 bytes OAEP's overhead is 2×hLen + 2 bytes. For longer messages, use AES hybrid encryption: encrypt AES key with OAEP, data with AES-GCM.

Quick Check

What property makes OAEP resistant to padding oracle attacks?

Recap

OAEP provides provable security for RSA encryption. Next we study RSA-PSS — the analogous improvement for RSA signatures.

Frequently asked questions

Is the “OAEP: Optimal Asymmetric Encryption Padding” lesson free?

Yes — the full text of “OAEP: Optimal Asymmetric Encryption Padding” is free to read here on the web, and the Cryptology Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cryptology Academy course, upgrade to CoddyKit PRO.

What will I learn in “OAEP: Optimal Asymmetric Encryption Padding”?

Walk through OAEP encoding and how it achieves IND-CCA2 security. You practise Cryptology Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cryptology Academy?

No prior experience is required. Cryptology Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “OAEP: Optimal Asymmetric Encryption Padding” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cryptology Academy lesson?

Yes. Every Cryptology Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Textbook RSA & Why It Is Insecure
  2. PKCS#1 v1.5 Padding & Bleichenbacher
  3. OAEP: Optimal Asymmetric Encryption Padding
  4. RSA-PSS for Digital Signatures
← Back to Cryptology Academy