Change RSA padding default to OAEP

[bdewater]

PKCS#1 v1.5 has been unsafe since 1998's Bleichenbacher attack. Even if these PKey::RSA methods are deprecated in favor of the new PKey::PKey#{encrypt,decrypt} interface, they can and are still used as https://shopify.engineering/building-flex-comp shows - in which case this library is recommending unsafe defaults to people who are not intimitely familiar with cryptography.

[rhenium]

I disagree with this change in RSA#public_encrypt and #private_decrypt.

This will break existing applications using the default. It would be very annoying to track down such an issue since encrypted data doesn't contain information about the padding scheme.

Also, these legacy methods lack a way to specify OAEP parameters, which is necessary for interoperability with other applications. They use hard-coded parameters, SHA-1 in MGF1 and an empty label.

I think it's best to leave the behavior as it is now. They are meant for legacy applications only anyway.

[bdewater]

Would you consider a patch instead calling out the insecure default in the documentation?

[rhenium]

Yes, that would be useful!