This article was accepted into the corpus but its outbound wikilinks were never NER-processed — typical at the deepest BFS hop or when the run's entity cap was reached. No expansion funnel to show.
| OAEP | |
|---|---|
| Name | OAEP |
| Caption | Optimal asymmetric encryption padding |
| Introduced | 1994 |
| Designer | Bellare and Rogaway |
| Type | Padding scheme for public-key cryptography |
| Related | RSAES-OAEP, PKCS#1 v2.0, MGF1 |
OAEP is a padding scheme widely used to preprocess messages for asymmetric encryption, designed to provide semantic security under chosen plaintext and chosen ciphertext scenarios. It was introduced to strengthen the security of public-key encryption algorithms such as RSA, and to enable formal proofs relating encryption to underlying hard problems like the RSA problem and the Decisional Diffie–Hellman problem. OAEP combines pseudorandom functions, masking, and redundancy to transform plaintext prior to application of a trapdoor permutation.
OAEP was proposed in the 1990s by Moni Naor, Mihir Bellare, and Phillip Rogaway as part of a body of work addressing provable security for public-key cryptography. Early implementations and standardization involved contributors and organizations such as RSA Laboratories, IETF, and the National Institute of Standards and Technology. OAEP became prominent with adoption in standards like PKCS#1 and influenced constructions in systems used by OpenSSL, GnuPG, and a variety of commercial cryptographic libraries deployed by companies including Microsoft, Apple, and Google.
OAEP uses a combination of a mask generation function (commonly MGF1), a hash function (often SHA-1, SHA-256), and a fixed-length label to produce a padded message. The scheme composes operations: hashing of an optional label, random seed generation (from CSPRNG sources such as /dev/urandom), mask application via MGF, and concatenation into a padded block suitable for a trapdoor permutation like RSAES used in PKCS#1 v2.0. Designers reference primitives from HMAC families and constructions inspired by works from Diffie–Hellman era research. Implementers often rely on standards produced by IETF and guidance from ISO/IEC committees.
OAEP was analyzed in the framework of provable security by researchers including Mihir Bellare and Phillip Rogaway, and later by Victor Shoup and Moni Naor. Early proofs related OAEP to IND-CCA and IND-CPA notions under the random oracle model using assumptions about trapdoor permutations like RSA and hard problems such as the Integer factorization problem and Discrete logarithm problem. Subsequent scrutiny involved reductions to idealized or standard-model assumptions; critiques and refinements came from scholars at MIT, Stanford University, and École Normale Supérieure. The random oracle model debates referenced work by Russell Impagliazzo and Mihir Bellare, and standards bodies weighed these analyses during adoption.
Numerous variants extend OAEP: OAEP+ and modifications for lattice-based and code-based schemes to interact with primitives from NTRU, lattice-based schemes, and post-quantum efforts led by groups at NIST and PQCrypto. Hybrid constructions combine OAEP-style padding with authenticated encryption schemes exemplified by research from Phil Zimmermann and institutions like CERIAS and INRIA. Other extensions adapt mask generation using functions inspired by HKDF or alternative hash families such as SHA-3 to meet evolving standardization by organizations including IETF and ISO.
Implementations follow precise encoding and decoding steps specified in standards such as PKCS#1 v2.0 and implementations in libraries like OpenSSL, BoringSSL, LibreSSL, and WolfSSL. Critical implementation details include secure random seed generation (often using system providers from Windows Cryptography API or Linux kernel sources), constant-time operations to mitigate timing attacks investigated by teams at Microsoft Research and Stony Brook University, and careful handling of label fields to avoid interoperability issues noted in audits by NCC Group and Cure53. Compliance testing is performed by certification bodies such as NIST CMVP and auditors including KPMG and Deloitte in product evaluations.
OAEP is used primarily with asymmetric encryption in protocols and products: secure email systems like S/MIME, key transport in TLS versions prior to widespread ECDHE adoption, code signing infrastructures at organizations such as VeriSign/Symantec (historically), and secure key wrapping in PKIX and X.509 certificate ecosystems. Cryptographic toolkits used by projects such as Apache HTTP Server, Nginx, and cloud providers including Amazon Web Services and Microsoft Azure have historically supported OAEP for RSA-based operations. Research deployments in testbeds at CERN and DARPA projects used OAEP in prototype secure systems.
OAEP has been the subject of cryptanalytic study. Classic chosen-ciphertext analyses and implementation attacks include padding oracle attacks investigated by researchers at Microsoft Research and universities such as Brown University and University of California, Berkeley. Vulnerabilities often stem from incorrect implementation errors in libraries like early versions of OpenSSL and misconfiguration in server products from vendors like Apache; side-channel attacks exploiting timing and error messaging were demonstrated by teams at University of Pennsylvania and École Polytechnique Fédérale de Lausanne. Provable-security critiques by Victor Shoup and others prompted revisions to recommended usage, and ongoing post-quantum research at NIST reassesses padding approaches in light of quantum-resistant primitives.