An OAEP Variant With a Tight Security Proof.
Jakob Jönsson · 2002
We introduce the OAEP++ encoding method, which is an adaptation of the OAEP encoding method, replacing the last step of the encoding operation with an application of a block cipher such as AES. We demonstrate that if f is a one-way trapdoor function that is hard to invert, then OAEP++ combined with f is secure against an IND-CCA2 adversary in the random oracle model. Moreover, the security reduction is tight; an adversary against f-OAEP++ can be extended to an f-inverter with a running time linear in the number of oracle queries.