PKCS#1 OAEP (RSA)

PKCS#1 OAEP is an asymmetric cipher based on RSA and the OAEP padding. It is described in RFC8017 where it is called RSAES-OAEP.

It can only encrypt messages slightly shorter than the RSA modulus (a few hundred bytes).

The hash function must always be specified. Applications should use SHA-256 or a stronger hash function, and SHA-1 only when interoperability with legacy protocols requires it (SHA-1 is the default in RFC8017).

The following example shows how you encrypt data by means of the recipient’s public key (here assumed to be available locally in a file called public.pem):

>>> from Crypto.Cipher import oaep
>>> from Crypto.Hash import SHA256
>>> from Crypto.PublicKey import RSA
>>>
>>> message = b'You can attack now!'
>>> key = RSA.importKey(open('public.pem').read())
>>> cipher = oaep.new(key, hashmod=SHA256)
>>> ciphertext = cipher.encrypt(message)

The recipient uses its own private key to decrypt the message. We assume the key is stored in a file called private.pem:

>>> key = RSA.importKey(open('private.pem').read())
>>> cipher = oaep.new(key, hashmod=SHA256)
>>> message = cipher.decrypt(ciphertext)

Warning

PKCS#1 OAEP does not guarantee authenticity of the message you decrypt. Since the public key is not secret, everybody could have created the encrypted message. Asymmetric encryption is typically paired with a digital signature.

Note

This module does not generate nor load RSA keys. Refer to the Crypto.PublicKey.RSA module.

class Crypto.Cipher.oaep.HashLikeClass(*args, **kwargs)
class Crypto.Cipher.oaep.HashLikeModule(*args, **kwargs)
class Crypto.Cipher.oaep.PKCS1OAEP_Cipher(rsa_key, hashmod, mask_func, label, rand_func)

Cipher object for PKCS#1 OAEP. Do not create directly: use new() instead.

decrypt(ciphertext)

Decrypt a message with PKCS#1 OAEP.

Parameters:

ciphertext (bytes/bytearray/memoryview) – The encrypted message.

Returns:

The original message (plaintext).

Return type:

bytes

Raises:

  • ValueError – if the ciphertext has the wrong length, or if decryption fails the integrity check (in which case, the decryption key is probably wrong).

  • TypeError – if the RSA key has no private half (i.e. you are trying to decrypt using a public key).

encrypt(message)

Encrypt a message with PKCS#1 OAEP.

Parameters:

message (bytes/bytearray/memoryview) – The message to encrypt, also known as plaintext. It can be of variable length, but not longer than the RSA modulus (in bytes) minus 2, minus twice the hash output size. For instance, if you use RSA 2048 and SHA-256, the longest message you can encrypt is 190 byte long.

Returns:

The ciphertext, as large as the RSA modulus.

Return type:

bytes

Raises:

ValueError – if the message is too long.

Crypto.Cipher.oaep.new(rsa_key, *, hashmod, mask_func=None, label=b'', rand_func=None)
Return a cipher object PKCS1OAEP_Cipher

that can be used to perform PKCS#1 OAEP encryption or decryption.

Parameters:

  • rsa_key (RSA key object) – The key object to use to encrypt or decrypt the message. Decryption is only possible with a private RSA key.

  • hashmod (hash module or object) – The hash function to use. This can be a module under Crypto.Hash or an existing hash object created from any of such modules. It must always be specified: new protocols should use SHA-256 or a stronger hash function, while Crypto.Hash.SHA1 matches the RSAES-OAEP default defined in RFC8017, which some older protocols still require.

  • mask_func (callable) – A mask generation function that accepts two parameters: a string to use as seed, and the length of the mask to generate, in bytes. If not specified, the standard MGF1 consistent with hashmod is used (a safe choice). Modify it only if you know what you are doing (for instance, for interoperability): sender and receiver must use the same one.

  • label (bytes/bytearray/memoryview) – A label to apply to this particular encryption. If not specified, an empty string is used. Specifying a label does not improve security.

  • rand_func (callable) – A function that returns random bytes. The default is Crypto.Random.get_random_bytes().

Raises:

TypeError – if hashmod is not a hash module or object.

Return type:

PKCS1OAEP_Cipher