OAEP padding

Optimal Asymmetric Encryption Padding was proposed by Bellare and Rogaway in 1994. It mixes the message with random data through two hash functions, so the same plaintext encrypts differently every time. PKCS #1 v1.5 had no equivalent structure and was open to Bleichenbacher's attack in 1998. OAEP became the standard in PKCS #1 v2.0 the same year.

OAEP is not immune. Manger showed in 2001 that an implementation which reveals which error occurred during decryption can be exploited, just like a padding oracle. The scheme is sound, but the error handling in the code has to be silent and uniform.