Swift RSA OAEP SHA-256 Encryption Fails Due to Padding Error

Below is a list of things to check and adjust when you see a padding error in decryption while encrypting with RSA/OAEP–SHA256:

---

1. Public Key Format

Make sure the public key from the backend is in the correct DER format. For example, if the key you’re receiving is in PEM format, the header/footer may differ. Often you’ll see either:

• "-----BEGIN PUBLIC KEY-----" (X.509 format) or
• "-----BEGIN RSA PUBLIC KEY-----" (PKCS#1 format)

Your current replacement code assumes the second. A mismatch between the expected format and the actual data will result in an invalid key (and later a padding error when decrypting).

---

2. Key Attributes for SecKeyCreateWithData

When passing the key data to SecKeyCreateWithData, use only the attributes that are necessary and ensure they match the backend’s key size and type. For example, you might not need to set kSecReturnPersistentRef if you are not storing the key locally. For RSA keys, your attributes could be:

SWIFTCopied
let attributes: CFDictionary = [
    kSecAttrKeyType as String: kSecAttrKeyTypeRSA,
    kSecAttrKeyClass as String: kSecAttrKeyClassPublic,
    kSecAttrKeySizeInBits as String: 2048
] as CFDictionary

---

3. Encryption Parameters

The call to
SecKeyCreateEncryptedData(publicKey, .rsaEncryptionOAEPSHA256, bufferData as CFData, &error)
correctly uses the OAEP with SHA‑256 padding. Verify that the backend expects exactly that scheme. Any discrepancy (for example, if it expects PKCS#1 v1.5 padding) will result in decryption issues.

Also note that with OAEP the maximum length of the input data is limited to (keySize in bytes – 2 * hash size – 2). For a 2048‑bit key (256 bytes) with a 32‑byte hash (SHA‑256), you can only encrypt up to 256 – 2×32 – 2 = 190 bytes. Make sure your plaintext fits this limit.

---

4. Diagnosing the Issue

If you still get a padding error on the server:

• Double-check the key conversion.
  Confirm that after stripping the header/footer and decoding, the key data is truly in the format that SecKeyCreateWithData expects. For example, if your key is in X.509 format, use the corresponding header:

  SWIFTCopied
  let keyString = publicKey
      .replacingOccurrences(of: "-----BEGIN PUBLIC KEY-----\n", with: "")
      .replacingOccurrences(of: "\n-----END PUBLIC KEY-----", with: "")

• Print out the key data.
  You can log the key data’s hexadecimal representation to verify that it is the expected DER sequence.

• Review the backend’s expectations.
  Ensure that the backend is configured to decrypt RSA/OAEP with SHA‑256. Any mismatch in padding or hash algorithm will cause a padding error.

---

Revised Example

Here’s an updated version of your code that uses the more minimal key attributes (adjust the header/footer replacements as needed):

SWIFTCopied
static func encrypt(string: String, publicKey pemString: String?) -> String? {
    guard let pemString = pemString else { return nil }
    
    // Adjust the header/footer if needed (for example, for PKCS#1 vs. X.509)
    let keyString = pemString
        .replacingOccurrences(of: "-----BEGIN PUBLIC KEY-----\n", with: "")
        .replacingOccurrences(of: "\n-----END PUBLIC KEY-----", with: "")
    
    guard let keyData = Data(base64Encoded: keyString) else { return nil }
    
    let attributes: CFDictionary = [
        kSecAttrKeyType as String: kSecAttrKeyTypeRSA,
        kSecAttrKeyClass as String: kSecAttrKeyClassPublic,
        kSecAttrKeySizeInBits as String: 2048
    ] as CFDictionary
    
    var error: Unmanaged<CFError>? = nil
    guard let secKey = SecKeyCreateWithData(keyData as CFData, attributes, &error) else {
        print("Key creation error:", error.debugDescription)
        return nil
    }
    
    return encrypt(string: string, publicKey: secKey)
}

static func encrypt(string: String, publicKey: SecKey) -> String? {
    guard let bufferData = string.data(using: .utf8) else { return nil }
    
    var error: Unmanaged<CFError>?
    guard let encryptedData = SecKeyCreateEncryptedData(publicKey,
                                                        .rsaEncryptionOAEPSHA256, // OAEP with SHA‑256
                                                        bufferData as CFData,
                                                        &error) as Data? else {
        print("Encryption error:", error.debugDescription)
        return nil
    }
    return encryptedData.base64EncodedString()
}

---

Summary

A padding error on decryption usually means one of these issues:

• The public key is not in the expected format.
• The parameters used for encryption (e.g. OAEP with SHA‑256) do not match the decryption settings.
• The plaintext size exceeds the limit for the given key and padding scheme.

Verifying the public key’s format and ensuring that both your encryption call and the server’s decryption use the same OAEP hash algorithm (SHA‑256) should help resolve the issue.