# Is there a replacement for the deprecated public\_key:encrypt\_public?

**URL:** <https://erlangforums.com/t/is-there-a-replacement-for-the-deprecated-public-key-encrypt-public/4163>\
**Category:** Questions / Help\
**Tags:** public\_key\
**Created:** [November 6, 2024, 11:12am UTC](https://erlangforums.com/t/is-there-a-replacement-for-the-deprecated-public-key-encrypt-public/4163 "2024-11-06T11:12:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![juhlig](https://erlangforums.com/user_avatar/erlangforums.com/juhlig/32/837_2.png) [@juhlig](https://erlangforums.com/u/juhlig)\
**Post date:** [November 6, 2024, 11:12am UTC](https://erlangforums.com/t/is-there-a-replacement-for-the-deprecated-public-key-encrypt-public/4163/1 "2024-11-06T11:12:43Z")

</div>

I have an older application that uses `public_key:encrypt_public/4`, like so:

```erlang
public_key:encrypt_public(Msg, RsaPubKey, [{rsa_pad, RsaPadding}])

```

`RsaPadding` may be either `rsa_pkcs1_padding` or `rsa_pkcs1_oaep_padding`, depending on circumstances.

Since OTP 27, this raises a warning:

```erlang
public_key:encrypt_public/3 is deprecated; do not use

```

Looking at [the documentation](https://www.erlang.org/doc/apps/public_key/public_key.html#encrypt_public/3), it laconically says that this is a legacy function which, for security reasons, should not be used with `rsa_pkcs1_padding`. It does not mention any alternative or replacement, though.

---

<div class="post-metadata">

**Author:** ![ingela](https://erlangforums.com/letter_avatar_proxy/v4/letter/i/53a042/32.png) [@ingela](https://erlangforums.com/u/ingela)\
**Post date:** [November 6, 2024, 2:44pm UTC](https://erlangforums.com/t/is-there-a-replacement-for-the-deprecated-public-key-encrypt-public/4163/2 "2024-11-06T14:44:41Z")

</div>

The deprecation was reverted in OTP-27.1, as it is `rsa_pkcs1_padding` that is vulnerable to several attacks and rsa\_pkcs1\_oaep\_padding is better. We still do not recommend that you use `rsa_pkcs1_padding` although new OpenSSL crypto libs have a mitigation for the vulnerability, this padding has proven to be very problematic and and broken several times first time in 1998. So from our perspective we still think that moving on to other and better alternatives is the way to go.

---

<div class="post-metadata">

**Author:** ![ingela](https://erlangforums.com/letter_avatar_proxy/v4/letter/i/53a042/32.png) [@ingela](https://erlangforums.com/u/ingela)\
**Post date:** [November 6, 2024, 2:47pm UTC](https://erlangforums.com/t/is-there-a-replacement-for-the-deprecated-public-key-encrypt-public/4163/3 "2024-11-06T14:47:26Z")

</div>

It does mention that for digital signatures sign/verify is a better choice. But for other cases I guess rsa\_pkcs1\_oaep\_padding can be the choice, and that is also why we reverted the deprecation.

---

<div class="post-metadata">

**Author:** ![juhlig](https://erlangforums.com/user_avatar/erlangforums.com/juhlig/32/837_2.png) [@juhlig](https://erlangforums.com/u/juhlig)\
**Post date:** [November 6, 2024, 3:20pm UTC](https://erlangforums.com/t/is-there-a-replacement-for-the-deprecated-public-key-encrypt-public/4163/4 "2024-11-06T15:20:14Z")

</div>

Thank you 🙂