Missing RSA padding may weaken the encryption

[douglasheld]

In BaseCipherSuitePlugin/KeyExchangeAlgorithmRSA.cs, line 78 the RSACryptoProvider is instructed to encrypt without OAEP padding, which may weaken the encryption. Basically the second parameter is "false" instead of "true". Reconsider whether you are using the API correctly in this case.

The same pattern is also seen on line 113.

[SlEventHorizon]

@douglasheld
As RFC 5246 specifies, RSA must be used with PKCS#1v1.5 padding which is the padding used when setting the parameter to false. OAEP padding will reduce compatibility between other protocol versions.