Module oaep 

RSA-OAEP encryption padding (RFC 8017 / PKCS#1 v2.2 §7.1).

OAEP is the modern RSA encryption padding and supersedes PKCS#1 v1.5 in every protocol designed after the Bleichenbacher era.

Hash agility

Per RFC 8017 §7.1 the scheme is parameterised by two hash functions: the label hash Hash (used for lHash = Hash(L) and to size the seed) and the mask generation function hash (MGF1’s underlying Hash). They may differ. The generic oaep_encrypt_with / oaep_decrypt_with take both as type parameters <H, MGF>; the oaep_encrypt / oaep_decrypt convenience wrappers fix both to SHA-256 (the historical default and the byte-for-byte-stable public symbols that pre-existed the hash-agility change).

Side-channel posture

OAEP is structurally harder to break with padding-oracle attacks than PKCS#1 v1.5, because the label-hash check at the top of decryption is naturally constant-time when implemented carefully. Items on the audit list (T2-J is the workspace roadmap entry covering both PKCS#1 v1.5 and OAEP):

• The H(L) comparison must use silentops::ct_eq, not ==.
• The 0x01 separator byte search must not branch on its position (CT scan + branchless flag accumulation).
• All decrypt errors must produce the same byte length and the same elapsed time.

This module relies on super::rsa::rsa_decrypt_raw, which is itself not yet protected against Bellcore (roadmap item T1-C). A CRT-faulted decrypt produces a malformed plaintext that OAEP rejects, but the rejection itself can leak gcd(N, S - S') to the attacker. See arcana/doc/sca/countermeasures/rsa.rst.

Functions

oaep_decrypt

OAEP decrypt a ciphertext using SHA-256 for both the label hash and MGF1 (convenience wrapper over oaep_decrypt_with).

oaep_decrypt_with

OAEP decrypt a ciphertext, generic over the label hash H and the MGF1 hash MGF (RFC 8017 §7.1.2).

oaep_encrypt

OAEP encrypt a message with RSA using SHA-256 for both the label hash and MGF1 (convenience wrapper over oaep_encrypt_with).

oaep_encrypt_with

OAEP encrypt a message with RSA, generic over the label hash H and the MGF1 hash MGF (RFC 8017 §7.1.1).