fix: Use of RSA algorithm without OAEP

[ptrgits]

Description of Fix
This update enhances the security of RSA encryption and decryption operations by ensuring that OAEP padding is consistently used instead of PKCS1Padding.

The following changes have been made:

1. decryptAsymmetric method in DecryptionHelper.java

   • Updated the cipher initialization to use OAEP padding by replacing the ASYMMETRIC_CIPHER constant with the explicit transformation string "RSA/ECB/OAEPWithSHA-1AndMGF1Padding".
   • No other changes were made to the method’s logic.

2. ASYMMETRIC_CIPHER constant in YotiConstants.java

   • Changed the value from PKCS1Padding to OAEP padding, setting it to "RSA/NONE/OAEPWithSHA1AndMGF1Padding".
   • This ensures that all usages of ASYMMETRIC_CIPHER across the codebase (including in DecryptionHelper.java) use OAEP padding for RSA decryption by default.
   • No additional changes are required unless compatibility with legacy systems using PKCS1Padding is explicitly needed (not applicable in the current context).

3. encryptAsymmetric method in DecryptionHelper.java

   • Modified the cipher initialization to use OAEP padding by replacing the ASYMMETRIC_CIPHER constant with "RSA/ECB/OAEPWithSHA-1AndMGF1Padding".
   • Other usages of ASYMMETRIC_CIPHER remain unchanged.
   • No new imports were required, as the necessary classes are already available.

Impact
These changes ensure that RSA encryption and decryption operations use OAEP padding, which provides better security properties and mitigates the risk of padding oracle attacks.

References

Mobile Security Testing Guide
The Padding Oracle Attack
CWE-780