I have a case where I need to create recovery accounts and I want to create them so that nobody knows the password to them until/unless necessary. Hence, I thought that I would do it using RSA - when the account is created via code, it will generate a random password for it that is then also encrypted with a public key and stored for possible later use.

Since the plaintext will be short, say 160 bits with a 20 character alphanumeric password, there's no need to do RSA->AES symmetric encryption. However, that makes me wonder about the security implications:

Since an attacker could get access to the public key and encrypted password, a chosen plaintext attack would be possible to try to bruteforce the password since RSA is normally deterministic. However, if I use PKCS #1 v1.5 padding (or OAEP), that should be covered, right? Or should there be random padding (anyway) - the plaintext is limited in scope and length?

2 Answers 2


Well, you said that "RSA is normally deterministic", but that's the point: RSA encryption is normally non-deterministic. By "normally" I mean "when performed as is described in the relevant standard", namely PKCS#1. Both the old ("v1.5") and the new ("OAEP") RSA encryption methods include randomness, and that is voluntary: this is precisely to prevent exhaustive search on the plaintext.

The operation that lies at the core of RSA (the modular exponentiation) is deterministic, but don't let it fool you; RSA asymmetric encryption, just like any other decent asymmetric encryption, is randomized.

(Some people call the raw modular exponentiation "textbook RSA" as if it was an algorithm in its own right, but that's just wrong and confusing.)


You are correct that you have to introduce randomness in order to mitigate a chosen plaintext attack. I'm no cryptographer, but I note that OAEP requires a random input, and that looks sufficient to me. OAEP was invented for just this purpose.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .