Problem - Kevin Tafuro

With EME-OAEP padding, the message is padded by a random value output from a
cryptographic one-way hash function. There are two parameters for EME-OAEP
padding: the hash function to use and an additional function used internally by the
padding mechanism. The only internal function in widespread use is called MGF1
and is defined in PKCS #1 v2.0 and later. While any cryptographic one-way hash
algorithm can be used with EME-OAEP padding, many implementations are hardwired
to use SHA1. Generally, you should decide which hash algorithm to use based
on the level of security you need overall in your application, assuming that hash
functions give you half their output length in security. That is, if you’re comfortable
with 80 bits of security (which we believe you should be for the foreseeable future),
SHA1 is sufficient. If you’re feeling conservative, use SHA-256, SHA-384, or SHA-
512 instead.
When using EME-OAEP padding, if k is the number of bytes in your public RSA
modulus, and if h is the number of bytes output by the hash function you choose, the
maximum message length you can encrypt is k -(2h + 2) bytes. For example, if
you’re using 2,048-bit RSA and SHA1, then k = 2,048 / 8 and h = 20. Therefore, you
can encrypt up to 214 bytes. With OpenSSL, specifying EME-OAEP padding forces
the use of SHA1.
Do not use PKCS #1 v1.5 public key padding for any purpose other than encrypting
session keys or hash values. This form of padding can encrypt messages up to 11
bytes smaller than the modulus size in bytes. For example, if you’re using 2,048-bit
RSA, you can encrypt 245-byte messages.
With OpenSSL, encryption with RSA can be done using the function RSA_public_
encrypt( ):
int RSA_public_encrypt(int l, unsigned char *pt, unsigned char *ct, RSA *r, int p);
This function has the following arguments:
l
pt
ct
r
p
Length of the plaintext to be encrypted.
Buffer that contains the plaintext data to be encrypted.
Buffer into which the resulting ciphertext data will be placed. The size of the
buffer must be equal to the size in bytes of the public modulus. This value can be
obtained by passing the RSA object to RSA_size( ).
RSA object containing the public key to be used to encrypt the plaintext data. The
public modulus (n) and the public exponent (e) must be filled in, but everything
else may be absent.
Type of padding to use.
334 | Chapter 7: Public Key Cryptography
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.