I have been encrypting messages and specifying RSA-OAEP padding with OpenSSL 1.0.2k, using the following command:

openssl cms -encrypt -in content.txt -out message.msg \
-recip public-key.pem -keyopt rsa_padding_mode:oaep

And can decrypt them fine when still using v1.0.2k.

When trying to decrypt the message in an environment using OpenSSL 1.0.1e, I would expect that decryption would fail, as on the documentation for OpenSSL cms, it says:

Support for RSA-OAEP and RSA-PSS was first added to OpenSSL 1.1.0

However when I use the following command to try and decrypt the message (this would be within the v1.0.1e environment), the message is decrypted successfully and displays the original plaintext content.

openssl cms -decrypt -in message.msg -recip \
recipient-combined-key.pem -inkey private-key.pem

I would expect decryption to fail in this case, as surely the version without support for RSA-OAEP would have no knowledge of the padding scheme used?

I have also tested signed messages using RSA-PSS padding, and in that case the signature cannot be verified on the older version of OpenSSL without RSA-PSS support. Can someone explain why this is the case for PSS padding, and not OAEP padding?


OpenSSL 1.0.1 supports both OAEP and PSS padding modes, it is the cms tool that doesn't. Using cms to decrypt with OAEP padding works in 1.0.1 incidentally because the decryption function cms calls automatically determines the padding mode. The function called to verify a signature doesn't do this and defaults to PKCS1, so it fails.

The cms tool was updated in 1.1.0 to, among other things, allow the -keyopt option so that padding can be specified when encrypting or signing, and to determine the padding type when verifying. This change was backported to 1.0.2.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.