The OAEP encryption scheme was introduced by Bellare and Rogaway at Eurocrypt ’94. It converts any trapdoor permutation scheme into a public-key encryption scheme. OAEP is widely believed to provide resistance against adaptive chosen ciphertext attack. The main justification for this belief is a supposed proof of security in the random oracle model, assuming the underlying trapdoor permutation scheme is one way.
This paper shows conclusively that this justification is invalid. First, it observes that there appears to be a non-trivial gap in the OAEP security proof. Second, it proves that this gap cannot be filled, in the sense that there can be no standard “black box” security reduction for OAEP. This is done by proving that there exists an oracle relative to which the general OAEP scheme is insecure.
The paper also presents a new scheme OAEP+, along with a complete proof of security in the random oracle model. OAEP+ is essentially just as efficient as OAEP, and even has a tighter security reduction.
It should be stressed that these results do not imply that a particular instantiation of OAEP, such as RSA-OAEP, is insecure. They simply undermine the original justification for its security. In fact, it turns out— essentially by accident, rather than by design—that RSA-OAEP is secure in the random oracle model; however, this fact relies on special algebraic properties of the RSA function, and not on the security of the general OAEP scheme.
KeywordsEncryption Scheme Random Oracle Random Oracle Model Oracle Query Decryption Oracle
- [BDPR98]M. Bellare, A. Desai, D. Pointcheval, and P. Rogaway. Relations among notions of security for public-key encryption schemes. In Advances in Cryptology-Crypto’ 98, pages 26–45, 1998.Google Scholar
- [Bon01]D. Boneh. Simplified OAEP for the RSA and Rabin functions. In Advances in Cryptology-Crypto 2001, 2001.Google Scholar
- [BR93]M. Bellare and P. Rogaway. Random oracles are practical: a paradigm for designing efficient protocols. In First ACM Conference on Computer and Communications Security, pages 62–73, 1993.Google Scholar
- [BR94]M. Bellare and P. Rogaway. Optimal asymmetric encryption. In Advances in Cryptology—Eurocrypt’ 94, pages 92–111, 1994.Google Scholar
- [CGH98]R. Canetti, O. Goldreich, and S. Halevi. The random oracle model, revisted. In 30th Annual ACM Symposium on Theory of Computing, 1998.Google Scholar
- [Cop96]D. Coppersmith. Finding a small root of a univariate modular equation. In Advances in Cryptology-Eurocrypt’ 96, pages 155–165, 1996.Google Scholar
- [DDN91]D. Dolev, C. Dwork, and M. Naor. Non-malleable cryptography. In 23rd Annual ACM Symposium on Theory of Computing, pages 542–552, 1991.Google Scholar
- [FOPS00]E. Fujisaki, T. Okamoto, D. Pointcheval, and J. Stern. RSA-OAEP is still alive! Cryptology ePrint Archive, Report 2000/061, 2000. http://eprint.iacr.org.
- [FOPS01]E. Fujisaki, T. Okamoto, D. Pointcheval, and J. Stern. RSA-OAEP is secure under the RSA assumption. In Advances in Cryptology-Crypto 2001, 2001.Google Scholar
- [NY90]M. Naor and M. Yung. Public-key cryptosystems provably secure against chosen ciphertext attacks. In 22nd Annual ACM Symposium on Theory of Computing, pages 427–437, 1990.Google Scholar
- [RS91]C. Rackoff and D. Simon. Noninteractive zero-knowledge proof of knowledge and chosen ciphertext attack. In Advances in Cryptology-Crypto’ 91, pages 433–444, 1991.Google Scholar
- [RSA78]R. L. Rivest, A. Shamir, and L. M. Adleman. A method for obtaining digital signatures and public-key cryptosystems. Communications of the ACM, pages 120–126, 1978.Google Scholar
- [Sho00]V. Shoup. OAEP reconsidered. Cryptology ePrint Archive, Report 2000/060, 2000. http://eprint.iacr.org.