370 – Use OAEP padding with RSA

Summary

RSA asymmetric encryption should be used only with OAEP padding (Optimal Asymmetric Encryption Padding).

Description

This means that any encryption or decryption processes involving RSA should adhere to the OAEP padding scheme. OAEP is considered more secure than older padding schemes. Padding schemes are employed to add randomness and complexity to the plaintext before being encrypted to enhance security.

Supported In

Advanced: True

References

• CAPEC-20. Encryption brute forcing
• HIPAA-164_312_a_2_iv. Encryption and decryption (addressable)
• HITRUST-10_g. Key management
• ISO27002-8_24. Use of cryptography
• IEC62443-DC-4_3. Use of cryptography
• CWE-780. Use of RSA algorithm without OAEP
• ISO27001-8_24. Use of cryptography

Last updated

2024/01/18