Slides · 8 slides
RSA padding: OAEP, PKCS#1 v1.5, and why raw RSA fails
The same module told visually, ready to present. Speaker notes carry the full explanation.
Public-key
RSA padding: OAEP, PKCS#1 v1.5
Textbook RSA is deterministic and malleable. Padding is what makes it safe
1990s padding
PKCS#1 v1.5 encryption layout
Advanced · the oracle
Bleichenbacher, one bit at a time
25 years of variants
It keeps coming back
TLS 1.2's fix: on failure, silently use a random premaster secret
The modern replacements
OAEP and PSS
Inside OAEP
Seed and mask, twice
OAEP encoding: two rounds of masking
The seed masks DB (top); the resulting maskedDB then masks the seed right back (middle, dashed line shows the original seed feeding that second XOR) — each half depends on the other, which is what makes recovering any part of the message require recovering the entire encoded block.
The overhead tax
How much fits in one RSA block
v1.5: k − 11 bytes · OAEP: k − 2h − 2 bytes
Takeaway
Padding is load-bearing
Keys: ← → move, F full screen, G all slides, N notes