Rule Definition
Optimal Asymmetric Encryption Padding schemes are often used with cryptographic algorithms to make the plaintext less predictable and complicate attack efforts. The OAEP scheme is often used with RSA to nullify the impact of predictable common text.

Remediation
Federal agencies are encouraged to use the Advanced Encryption Standard, a faster and stronger algorithm approved as FIPS 197 in 2001.

Violation Code Sample

fun encrypt(message: String, key: String): String {
    val encryptedBytes: ByteArray
    val pubKey: PublicKey? = key.toPublicKey()
    val cipher: Cipher = Cipher.getInstance("RSA/None/NoPadding") //Violation

    cipher.init(Cipher.ENCRYPT_MODE, pubKey)
    encryptedBytes = cipher.doFinal(message.toByteArray(StandardCharsets.UTF_8))

    return Base64.encodeToString(encryptedBytes, Base64.DEFAULT)
}

Fixed Code Sample

fun encrypt(message: String, key: String): String {
    val encryptedBytes: ByteArray
    val pubKey: PublicKey? = key.toPublicKey()
    val cipher: Cipher = Cipher.getInstance("RSA/ECB/OAEPWithSHA1AndMGF1Padding") //Violation fixed
/*other OAEP paddings:
OAEPPadding  
OAEPwithSHA-1andMGF1Padding
OAEPwithSHA-256andMGF1Padding  
OAEPwithSHA-224andMGF1Padding
OAEPwithSHA-384andMGF1Padding
OAEPwithSHA-512andMGF1Padding    

*/

    cipher.init(Cipher.ENCRYPT_MODE, pubKey)
    encryptedBytes = cipher.doFinal(message.toByteArray(StandardCharsets.UTF_8))

    return Base64.encodeToString(encryptedBytes, Base64.DEFAULT)
}

https://cwe.mitre.org/data/definitions/780.html https://rdist.root.org/2009/10/06/why-rsa-encryption-padding-is-critical/