NDLI: How to Strengthen the Security of RSA-OAEP

Content Provider	IEEE Xplore Digital Library
Author	Boldyreva, A. Imai, H. Kobara, K.
Copyright Year	1963
Abstract	OAEP is one of the few standardized and widely deployed public-key encryption schemes. It was designed by Bellare and Rogaway as a scheme based on a trapdoor permutation such as RSA. RSA-OAEP is standardized in RSA's PKCS #1 v2.1 and is part of several standards. OAEP was shown to be IND-CCA secure assuming the underlying trapdoor permutation is partial one-way, and RSA-OAEP was proven to be IND-CCA under the standard RSA assumption, both in the random oracle model. However, the latter reduction is not tight, meaning that the guaranteed level of security is not very high for a practical parameter choice. We observe that the situation is even worse because both analyses were done in the single-query setting, i.e., where an adversary gets a single challenge ciphertext. This does not take into account the fact that in reality an adversary can observe multiple ciphertexts of related messages. The results about the multiquery setting imply that the guaranteed concrete security can degrade by a factor of q , which is the number of challenge ciphertexts an adversary can get. We propose a very simple modification of the OAEP encryption, which asks that the trapdoor permutation instance is only applied to a part of the OAEP transform. We show that IND-CCA security of this scheme is tightly related to the hardness of one-wayness of the trapdoor permutation in the random oracle model. This implies tight security for RSA-OAEP under the RSA assumption. We also show that security does not degrade as the number of ciphertexts an adversary can see increases. Moreover, OAEP can be used to encrypt long messages without using hybrid encryption. We believe that this modification is easy to implement, and the benefits it provides deserves the attention of standard bodies.
Sponsorship	IEEE Information Theory Society
Starting Page	5876
Ending Page	5886
Page Count	11
File Size	937261
File Format	PDF
ISSN	00189448
Volume Number	56
Issue Number	11
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2010-11-01
Publisher Place	U.S.A.
Access Restriction	One Nation One Subscription (ONOS)
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Encryption Concrete Generators Transforms Public key RSA-OAEP Cryptography standards encryption provable security
Content Type	Text
Resource Type	Article
Subject	Library and Information Sciences Information Systems Computer Science Applications

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Dual RSA and Its Security Analysis

Multirecipient Encryption Schemes: How to Save on Bandwidth and Computation Without Sacrificing Security

Selective opening security of practical public-key encryption schemes

A modification of the RSA public-key encryption procedure (Corresp.)

How to fool an unbounded adversary with a short key

One-Wayness Equivalent to General Factoring

Cryptanalysis of RSA with private key d less than N/sup 0.292/

Unconditionally Secure Steganography Against Active Attacks

Transitive signatures: new schemes and proofs

How to Strengthen the Security of RSA-OAEP

Similar Documents

Dual RSA and Its Security Analysis

Multirecipient Encryption Schemes: How to Save on Bandwidth and Computation Without Sacrificing Security

Selective opening security of practical public-key encryption schemes

A modification of the RSA public-key encryption procedure (Corresp.)

How to fool an unbounded adversary with a short key

One-Wayness Equivalent to General Factoring

Cryptanalysis of RSA with private key d less than N/sup 0.292/

Unconditionally Secure Steganography Against Active Attacks

Transitive signatures: new schemes and proofs

How to Strengthen the Security of RSA-OAEP