 RSA padding schemes must be carefully designed so as to prevent sophisticated attacks which may be facilitated by a predictable message structure.Early versions of the PKCS#1 standard (up to version 1.5) used a construction that appears to make RSA semantically secure.However, at Crypto 1998, Bleichenbacher showed that this version is vulnerable to a practical adaptive chosen ciphertext attack.