Minds/mobile

Consider using libsodium instead of RSA-PKCS1

paragonie-scott opened this issue · 2 comments

Cipher cipher = Cipher.getInstance("RSA/ECB/PKCS1Padding");

Referring to (Updated) Cryptographic Right Answers:

  • If you're going to use RSA, use RSA-OAEP, not RSA-PKCS1
  • ECB mode should never be used for encrypting sensitive information

If you would like, Paragon Initiative Enterprises can audit your entire application and harden your cryptography protocols while preventing other security risks (gratis).

If you are interested, Robosodium ought to be a good shim for a modern, fast, and secure elliptic curve cryptography library (libsodium, which is a portable fork of NaCl).

This title change is incorrect. Instead of "consider using RSA-OAEP", it should read, "consider using libsodium".