Q:

fOAEP parameter in RSA encryption

RSACryptoServiceProvider.Encrypt() has two parameters: rgb (the data to encrypt), and fOAEP. fOAEP is a boolean value which determines what kind of padding should be used:
fOAEP
Type: System.Boolean

true to perform direct RSA encryption using OAEP padding (only available on a computer running Microsoft Windows XP or later); otherwise, false to use PKCS#1 v1.5 padding. 

It says that true will only work on Windows XP or later, but I assume that that doesn't necessarily include Linux and other languages. That being said, this does need to work on Linux and with PHP. Given that my two biggest priorities are security, and interoperability with a PHP script, should this value be true of false?

A:

It's all very well documented and conforms to standards on the .NET side, I assume it should be the same on PHP side. Look at this for example:
http://www.php.net/manual/en/function.openssl-public-encrypt.php
It supports both OAEP and PKCS#1. So you should be fine with either of them. My private opinion is that it is not some exotic stuff like the old .DOC format where interoperability is a nightmare. RSA itself is pretty simple, the padding is just adding some binary bytes, there's a lot of thought behind it but it's very simple.
About which is more secure, see this:
https://security.stackexchange.com/questions/32050/what-specific-padding-weakness-does-oaep-address-in-rsa
Or try to find other cryptographic research. Don't trust what I'm saying :).
EDIT: oops, decryption doesn't seem to support OAEP, one more thing to add to phpwtf.org...
http://www.php.net/manual/en/function.openssl-public-decrypt.php

