OAEP Reconsidered

By Victor Shoup. 2001

450 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

Citations in the corpus

Prio: Private, Robust, and Scalable Computation of Aggregate Statistics (2017, background): “Towards this end, we assume the existence of a publickey infrastructure and the basic cryptographic primitives (CCA-secure public-key encryption [43, 108, 109], digital signatures [71], etc.”
A computationally sound mechanized prover for security protocols (2006, methodology): “These proofs are presented as sequences of games, as used by cryptographers [15] [42] [43]: the initial game represents the protocol to prove; the goal is to show that the probability of breaking a certain security property (secrecy in this paper) is negligible in this game; intermediate games are…”
Formal certification of code-based cryptographic proofs (2009, background): “[31]), and the cryptographic community is in creasingly wary that the field may be approaching a crisis of rigor [ 9, 21].”
Introduction to Modern Cryptography, Second Edition (2014, unknown): “The original proof of OAEP was later found to be flawed; the interested reader is referred to [39, 158, 68].”
Password-Based Authenticated Key Exchange in the Three-Party Setting (2005, unknown): “By Lemma 1 of [25], we have |Pr[SuccVi−1 ] − Pr[SuccVi ]| ≤ Pr[F ].”
RSA-OAEP Is Secure under the RSA Assumption (2001, background): “Victor Shoup [15] recently showed that it is quite unlikely that such a security proof exists — at least for non-malleability — under the one-wayness of the permutation.”
Lecture Notes on Cryptography (2001, background): “It is shown in [89] (building on [194]) that it also achieves a notion called “plaintext-aware encryption” defined in [25, 21].”
The Two Faces of Lattices in Cryptology (2001, methodology): “In particular, this has led to surprising attacks on the RSA [120] cryptosystem in special settings such as low public or private exponent, but curiously, also to new security proofs [128,18].”
Modern Cryptography: Theory and Practice (2003, methodology): “Shoup observes that the original OAEP security argument (for IND-CCA2 security) contains a flaw [270].”