Instantiability of RSA-OAEP under chosen-plaintext attack

Eike Kiltz, Adam O'Neill, Adam Smith

Research output: Chapter in Book/Report/Conference proceedingConference contribution

60 Scopus citations

Abstract

We show that the widely deployed RSA-OAEP encryption scheme of Bellare and Rogaway (Eurocrypt 1994), which combines RSA with two rounds of an underlying Feistel network whose hash (i.e., round) functions are modeled as random oracles, meets indistinguishability under chosen-plaintext attack (IND-CPA) in the standard model based on simple, non-interactive, and non-interdependent assumptions on RSA and the hash functions. To prove this, we first give a result on a more general notion called "padding-based" encryption, saying that such a scheme is IND-CPA if (1) its underlying padding transform satisfies a "fooling" condition against small-range distinguishers on a class of high-entropy input distributions, and (2) its trapdoor permutation is sufficiently lossy as defined by Peikert and Waters (STOC 2008). We then show that the first round of OAEP satifies condition (1) if its hash function is t-wise independent for appopriate t and that RSA satisfies condition (2) under the Φ-Hiding Assumption of Cachin et al. (Eurocrypt 1999). This appears to be the first non-trivial positive result about the instantiability of RSA-OAEP. In particular, it increases our confidence that chosen-plaintext attacks are unlikely to be found against the scheme. In contrast, RSA-OAEP's predecessor in PKCS #1 v1.5 was shown to be vulnerable to such attacks by Coron et al. (Eurocrypt 2000).

Original languageEnglish (US)
Title of host publicationAdvances in Cryptology - CRYPTO 2010 - 30th Annual Cryptology Conference, Proceedings
Pages295-313
Number of pages19
DOIs
StatePublished - Sep 29 2010
Event30th Annual International Cryptology Conference, CRYPTO 2010 - Santa Barbara, CA, United States
Duration: Aug 15 2010Aug 19 2010

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume6223 LNCS
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349

Other

Other30th Annual International Cryptology Conference, CRYPTO 2010
CountryUnited States
CitySanta Barbara, CA
Period8/15/108/19/10

All Science Journal Classification (ASJC) codes

  • Theoretical Computer Science
  • Computer Science(all)

Fingerprint Dive into the research topics of 'Instantiability of RSA-OAEP under chosen-plaintext attack'. Together they form a unique fingerprint.

  • Cite this

    Kiltz, E., O'Neill, A., & Smith, A. (2010). Instantiability of RSA-OAEP under chosen-plaintext attack. In Advances in Cryptology - CRYPTO 2010 - 30th Annual Cryptology Conference, Proceedings (pp. 295-313). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 6223 LNCS). https://doi.org/10.1007/978-3-642-14623-7_16