Editing RSA cryptosystem (section)

===Padding schemes===
To avoid these problems, practical RSA implementations typically embed some form of structured, randomized [[Padding (cryptography)|padding]] into the value {{mvar|m}} before encrypting it. This padding ensures that {{mvar|m}} does not fall into the range of insecure plaintexts, and that a given message, once padded, will encrypt to one of a large number of different possible ciphertexts.

Standards such as [[PKCS1|PKCS#1]] have been carefully designed to securely pad messages prior to RSA encryption. Because these schemes pad the plaintext {{mvar|m}} with some number of additional bits, the size of the un-padded message {{mvar|M}} must be somewhat smaller. RSA padding schemes must be carefully designed so as to prevent sophisticated attacks that may be facilitated by a predictable message structure. Early versions of the PKCS#1 standard (up to version 1.5) used a construction that appears to make RSA semantically secure. However, at [[International Cryptology Conference|Crypto]] 1998, Bleichenbacher showed that this version is vulnerable to a practical [[adaptive chosen-ciphertext attack]]. Furthermore, at [[Eurocrypt]] 2000, Coron et al.<ref>{{Cite book |last1=Coron |first1=Jean-Sébastien |last2=Joye |first2=Marc |last3=Naccache |first3=David |last4=Paillier |first4=Pascal |title=Advances in Cryptology — EUROCRYPT 2000 |chapter=New Attacks on PKCS#1 v1.5 Encryption |date=2000 |editor-last=Preneel |editor-first=Bart |series=Lecture Notes in Computer Science |volume=1807 |language=en |location=Berlin, Heidelberg |publisher=Springer| pages=369–381 |doi=10.1007/3-540-45539-6_25 |isbn=978-3-540-45539-4 |doi-access=free}}</ref> showed that for some types of messages, this padding does not provide a high enough level of security. Later versions of the standard include [[Optimal Asymmetric Encryption Padding]] (OAEP), which prevents these attacks. As such, OAEP should be used in any new application, and PKCS#1&nbsp;v1.5 padding should be replaced wherever possible. The PKCS#1 standard also incorporates processing schemes designed to provide additional security for RSA signatures, e.g. the Probabilistic Signature Scheme for RSA ([[RSA-PSS]]).

Secure padding schemes such as RSA-PSS are as essential for the security of message signing as they are for message encryption. Two USA patents on PSS were granted ({{US patent|6266771}} and {{US patent|7036014}}); however, these patents expired on 24 July 2009 and 25 April 2010 respectively. Use of PSS no longer seems to be encumbered by patents.{{Original research inline|date=August 2019}} Note that using different RSA key pairs for encryption and signing is potentially more secure.<ref>{{Cite web | url=https://www.di-mgt.com.au/rsa_alg.html#weaknesses | title=RSA Algorithm}}</ref>