CWE-780 flags code that encrypts with RSA but does not use Optimal Asymmetric Encryption Padding (OAEP). The algorithm may be fine. The way it is being used is not.
It matters to anyone who encrypts data, keys or tokens with an RSA public key, which includes key exchange code, license checks and message encryption.
How it happens
Padding schemes make the plaintext less predictable before the math happens. MITRE explains that OAEP is the scheme commonly paired with RSA to nullify the effect of predictable common text.
Without it, the same input always produces the same output, and structure in the plaintext can show through. Developers end up here by choosing a raw or "no padding" mode, or by accepting an old default from a library.
A vulnerable pattern in Python with the cryptography package would be to rely on an older padding mode such as PKCS1v15 for encryption, or to use a raw RSA primitive directly.
What an attacker gains
According to the record, without OAEP it takes less work for an attacker to decrypt the data or to infer patterns from it. The listed impact is bypass of a protection mechanism. There are no observed CVEs in the record for this entry, so treat this as a design weakness to remove, not a single known exploit.
How to find it
MITRE says automated static analysis can find some instances. You can also:
- Search for RSA encryption calls and read which padding argument they pass.
- In Java, look for cipher strings such as RSA/ECB/NoPadding, or RSA/ECB/PKCS1Padding when used to encrypt.
- Check third-party libraries and their defaults, since the weak choice may be buried in a dependency.
How to fix it
Use OAEP with a modern hash, and keep RSA for small payloads such as wrapping a symmetric key.
Python:
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import padding
ciphertext = public_key.encrypt(
message,
padding.OAEP(
mgf=padding.MGF1(algorithm=hashes.SHA256()),
algorithm=hashes.SHA256(),
label=None,
),
)
Java:
Cipher c = Cipher.getInstance("RSA/ECB/OAEPWithSHA-256AndMGF1Padding");
c.init(Cipher.ENCRYPT_MODE, publicKey);
byte[] out = c.doFinal(message);
For anything larger than a key, generate a random symmetric key, encrypt the data with an authenticated cipher, and wrap only that key with RSA-OAEP. Prefer a high-level library that makes the safe choice the default.
Quick check
Does OAEP replace the need for a strong key size?
No. Padding and key size solve different problems. You need both.
