Problem - Kevin Tafuro

The constants that may be used to specify the type of padding to use, as well as the
prototype for RSA_public_encrypt( ), are defined in the header file openssl/rsa.h. The
defined constants are:
RSA_PKCS1_PADDING
Padding mode specified in version 1.5 of PKCS #1. This mode is in wide use,
but it should only be used for compatibility. Use the EME-OAEP padding
method instead.
RSA_PKCS1_OAEP_PADDING
EME-OAEP padding as specified in PKCS #1 Version 2.0 and later. It is what
you should use for new applications.
RSA_SSLV23_PADDING
The SSLand TLS protocols specify a slight variant of PKCS #1 v1.5 padding.
This shouldn’t be used outside the context of the SSL or TLS protocols.
RSA_NO_PADDING
This mode disables padding. Do not use this mode unless you’re using it to
implement a known-secure padding mode.
When you’re encrypting with RSA, the message you’re actually trying to encrypt is
represented as an integer. The binary string you pass in is converted to an integer for
you, using the algorithm described in Recipe 7.8.
You can encrypt only one integer at a time with most low-level interfaces, and the
OpenSSLinterface is no exception. This is part of the reason there are limits to message
size. In practice, you should never need a larger message size. Instead, RSA is
usually used to encrypt a temporary key for a much faster encryption algorithm, or to
encrypt some other small piece of data.
If there are a small number of possible plaintext inputs to RSA encryption,
the attacker can figure out which plaintext was used via a dictionary
attack. Therefore, make sure that there are always a reasonable
number of possible plaintexts and that all plaintexts are equally likely.
Again, it is best to simply encrypt a 16-byte symmetric key.
If you forego padding (which is insecure; we discuss it just to explain how RSA
works), the number you encrypt must be a value between 0 and n - 1, where n is the
public modulus (the public key). Also, the value must be represented in the minimum
number of bytes it takes to represent n. We recommend that you not do this
unless you absolutely understand the security issues involved. For example, if you’re
using OpenSSL, the only reason you should ever consider implementing your own
padding mechanism would be if you wanted to use EME-OAEP padding with a hash
algorithm stronger than SHA1, such as SHA-256. See the PKCS #1 v2.1 document
for a comprehensive implementation guide for EME-OAEP padding.
Performing Raw Encryption with an RSA Public Key | 335
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.