Use RSA-OAEP for any new RSA encryption. PKCS#1 v1.5 encryption padding is kept mainly for compatibility and is open to chosen-ciphertext attacks of the Bleichenbacher type. If a legacy peer forces v1.5, add countermeasures and plan a migration.
What the standard says
RFC 8017 (PKCS #1 version 2.2) states that RSAES-OAEP is required to be supported for new applications, and that RSAES-PKCS1-v1_5 is included only for compatibility with existing applications.
It also explains why. A padding scheme that lets an attacker tell valid from invalid ciphertexts can be exploited in a chosen-ciphertext attack, as in Bleichenbacher's attack. For v1.5 the RFC recommends rigorous conformance checking and consolidated error messages, and says using it to encrypt arbitrary messages, as opposed to randomly generated keys, is not recommended.
What this means in code
The usual safe pattern is to avoid encrypting data directly with RSA at all. Generate a random symmetric key, encrypt the data with an AEAD, and encrypt only that small key with RSA-OAEP. This is the hybrid approach, and it matches how envelope encryption works.
When you do call RSA encryption:
- Choose OAEP explicitly. Do not accept a library default without checking it.
- Pick a modern hash for OAEP, and keep the same hash for the mask function unless an interop need says otherwise.
- Use a key size of at least 2048 bits, and plan for longer-lived data to use stronger options.
If a legacy system needs v1.5
- Return the same error, with the same timing, for every decryption failure.
- Never expose whether padding was valid.
- Limit what it protects to random session keys.
- Put a retirement date on the interface and track it.
Many TLS-related attacks over the years exploited exactly this kind of oracle, which is one reason newer protocol versions dropped RSA key transport.
Signatures are a separate question
Do not mix up encryption padding with signature padding. For RSA signatures, RSASSA-PSS is the modern choice, and PKCS#1 v1.5 signatures are still widely accepted for compatibility. If you have a free choice, consider Ed25519 or ECDSA for signing instead. Our post on choosing signing keys covers that.
Quick check
Is RSA with PKCS#1 v1.5 padding broken everywhere?
Not in every deployment, but it carries a known class of attack whenever an oracle exists. OAEP removes that worry for new designs.
Can I encrypt a large file directly with RSA?
No. RSA handles only a small message limited by key size. Encrypt the file with a symmetric AEAD and wrap that key with RSA-OAEP.
Sources
Last reviewed: 19 October 2026.
