The software uses the RSA algorithm but does not incorporate
Optimal Asymmetric Encryption Padding (OAEP), which might weaken the
encryption.
Extended Description
Padding schemes are often used with cryptographic algorithms to make the
plaintext less predictable and complicate attack efforts. The OAEP scheme is
often used with RSA to nullify the impact of predictable common text.
Time of Introduction
Architecture and Design
Implementation
Common Consequences
Scope
Effect
Confidentiality
Without OAEP in RSA encryption, it will take less work for an attacker
to decrypt the data or to infer patterns from the ciphertext.
Likelihood of Exploit
Medium
Demonstrative Examples
Example 1
The example below attempts to build an RSA cipher.
This entry could probably have a new parent related to improper padding,
however the role of padding in cryptographic algorithms can vary, such as
hiding the length of the plaintext and providing additional random bits for
the cipher. In general, cryptographic problems in CWE are not well organized
and further research is needed.
Description
