Is semantic security important in a hybrid cryptosystem? RSA doesn't provide semantic security when used unmodified, and neither does the commonly used PKCS#1 v.1.5 padding scheme for encryption.

Is this a problem for hybrid cryptosystems at all?

My suspicion is that it isn't, since the plaintext message of the RSA encryption should be a random string used as an encryption key for the symmetric cipher used to encrypt the actual message, which would make the advantage an attacker could gain by the lack of semantic security pretty neglegible.

I guess that it's still a bad idea to rely on the randomness of the ciphertext in that way, but then again, as far as I understand, more secure padding schemes like OAEP also need a random input to guarantee semantic security, so by encrypting messages without a good entropy source seems to be equally bad in both cases.

To sum up my question:


Is semantic security necessary if the plaintext is guaranteed to be random for all messages encrypted by an asymmetric encryption scheme?
When the plaintext turn out to be not as random as expected (e.g. due to a broken RNG), is that worse than the RNG input for a semantically secure padding scheme being predictable?


Additionally, if it is, can anybody explain why PKCS#1 v.1.5 is still commonly used? As far as I know, GnuPG uses it exclusively for RSA encryption, and TLS does so as well for its RSA key exchange in many of its cipher suites.
Not a complete answer, but since you mentioned "unmodified RSA" I feel it's relevant.

Something stronger than vanilla RSA is necessary, even if it isn't semantic security.

Example: What if you have a public key exponent of 3 and the symmetric key being encrypted is 16 bytes long? Using raw RSA, $m^e$ would be about $128 \times 3 = 384$ bits long and thus smaller than any modern public key modulus would be. Being smaller than the modulus would prevent the calculation from taking advantage of the RSA Assumption, which is the premise of RSA's security. Since $m^e$ is easy to factor simply over the integers all security would be lost. (And this mistake would be somewhat obvious to the attacker because the vast majority of the high bits would all be 0.)