title: RSA and OAEP: Choosing or not choosing the Hash Algorithm?
body: <p>I am implementing an asymmetrical encryption system:</p>
  <pre><code>''' &lt;summary&gt;
  ''' A facade for a data asymmetrical encryption algorithm relying on a pair of public and private keys.
  ''' &lt;/summary&gt;
  Public Interface IAsymEncrypter
  
      ''' &lt;summary&gt;
      ''' The public key to rely upon for encrypting data. Under XML format.
      ''' &lt;/summary&gt;
      ReadOnly Property PublicKeyXml As String
  
      ''' &lt;summary&gt;
      ''' The private key to rely upon for decrypting data. Under XML format.
      ''' &lt;para&gt;Also contains the public key.&lt;/para&gt;
      ''' &lt;/summary&gt;
      ReadOnly Property PrivateKeyXml As String
  
      ''' &lt;summary&gt;
      ''' Encrypts data, using a public key.
      ''' &lt;/summary&gt;
      ''' &lt;param name=&quot;Data&quot;&gt;The data to encrypt.&lt;/param&gt;
      Function Encrypt(Data As Byte()) As Byte()
  
      ''' &lt;summary&gt;
      ''' Decrypts data, using a private key.
      ''' &lt;/summary&gt;
      ''' &lt;param name=&quot;Cipher&quot;&gt;The cipher to decrypt the data from.&lt;/param&gt;
      Function Decrypt(Cipher As Byte()) As Byte()
  
  End Interface
  </code></pre>
  <p>The implementation wraps an <code>RSACryptoServiceProvider</code>. The implementation of <code>Encrypt</code> and <code>Decrypt</code> requires a choice for padding. I have already researched and understand the following:</p>
  <ul>
  <li>OAEP padding should be prefered over PKCS.</li>
  <li>The weakness against collisions of the hash algorithm associated with OAEP is, to date, not of concern and should not be a decisive criterion.</li>
  <li>Relying on a shorter output hash allows encrypting larger strings.</li>
  </ul>
  <p>I am looking for the best security practices, whilst keeping maintenance as low as possible. I have seen that <code>.Encrypt</code> has two <a href="https://docs.microsoft.com/en-us/dotnet/api/system.security.cryptography.rsacryptoserviceprovider.encrypt" rel="nofollow noreferrer">overloads</a>:</p>
  <ul>
  <li><code>.Encrypt(Data as Byte(), fOAEP as Boolean) as Byte()</code>, where <code>fOAEP</code> should be set to <code>True</code> to rely on OAEP. I assume this means the hash algorithm is chosen automatically; upon which criteria, that I did not figure out.</li>
  <li><code>.Encrypt(Date as Byte(), Padding as RsaEncryptionPadding) as Byte()</code>, where one can specify OAEP associated with SHA-1 to SHA512.</li>
  </ul>
  <p>Two questions:</p>
  <ol>
  <li>Is the padding mode stored alongside the encrypted message? That is, can I guess from an encrypted message which padding mode to use to decrypt it?</li>
  <li>If no, then I guess I am better off choosing the mode myself, in which case I would like to know if there are other considerations I should take into account?</li>
  </ol>