I have been encrypting messages and specifying RSA-OAEP padding with OpenSSL 1.0.2k, using the following command:
openssl cms -encrypt -in content.txt -out message.msg \ -recip public-key.pem -keyopt rsa_padding_mode:oaep
And can decrypt them fine when still using v1.0.2k.
When trying to decrypt the message in an environment using OpenSSL 1.0.1e, I would expect that decryption would fail, as on the documentation for OpenSSL cms, it says:
Support for RSA-OAEP and RSA-PSS was first added to OpenSSL 1.1.0
However when I use the following command to try and decrypt the message (this would be within the v1.0.1e environment), the message is decrypted successfully and displays the original plaintext content.
openssl cms -decrypt -in message.msg -recip \ recipient-combined-key.pem -inkey private-key.pem
I would expect decryption to fail in this case, as surely the version without support for RSA-OAEP would have no knowledge of the padding scheme used?
I have also tested signed messages using RSA-PSS padding, and in that case the signature cannot be verified on the older version of OpenSSL without RSA-PSS support. Can someone explain why this is the case for PSS padding, and not OAEP padding?