Is RSA padding needed for single recipient, one-time, unique random message? I want a way to encrypt files using this process: https://crypto.stackexchange.com/a/15 . That is: generate a random password, use that to AES-encrypt a file, and use an RSA public key to encrypt the random password.

I can arrange for the password (= AES key) to be randomly generated every single time, and can arrange things so that doing so again with either the same or a different RSA key will result in a new AES password being generated. My question is whether I need to use padding when doing RSA encryption of the unique AES key.

I've read the answers to several closely related questions, especially Is RSA of a random nonce with no padding safe? and also Does RSA padding have to be unpredictable if the payload is?, which state that padding is necessary. But, as I read the replies, it seems to be necessary in the context of multiple recipients, in which there multiple RSA public keys, but only one random AES password (random but generated once only, not generated anew for each RSA key / recipient).

Basically, in my case, I don't see how padding an already known-to-be-uniquely-random message would make it any more random.

So: Am I just confused and missing something, or are the linked answers only emphasizing
the need for padding in multiple recipient cases (where the password stays the same)?
I recommend that you stick with the standard padding methods, even in your scenario.

Here's one reason, if your 'random password' consists only of the AES key, and you use the raw RSA operation on it (that is, zero pad it to the size of the RSA modulus, and then compute $M^e \bmod N$), then yes, there does exist weaknesses; there's a meet-in-the-middle attack on it that will search through possible values of $M$ faster than brute force.

Here's how that would work; in a preprocessing phase, the attacker would generate two lists of integers between 1 and $2^{128/2}$ (assuming we're attacking a 128 bit AES key) $A_i$ and $B_i$.  Then, he computes two lists, one consisting of the values $A_i ^ {-e} \bmod N$, and the other consisting of the values $B_i ^ e \bmod N$

Now, when the attacker sees an encrypted message $M^e \bmod N$, he computes the list $(M^e \bmod N) \cdot (A_i ^ {-e} \bmod N) = (M \cdot A_i^{-1})^e \bmod N$, and then scans that list for values in common with the $B_i ^ e \bmod N$ list (which can be done by sorting the lists and doing one pass through both of them).  If there is a pair with $(M \cdot A_i^{-1})^e \bmod N = B_j ^ e \bmod N$, the attacker then knows the value $M = A_i \cdot B_j$.

If the size of the lists $A_i$, $B_i$ are $k$ elements long, the attacker has just searched through $k^2$ values of the message in $O(k \log k)$ time.

Now, I'm not sure how much concern this attack would be in practice; however, RSA with standard padding methods do not have this concern; that would appear (to me at least) enough of a reason to stick with the standard methods.

Another way to look at it; raw RSA (that is, RSA without padding) is fragile; while RSA with good padding is not.  Given that good padding is easy to do, why wouldn't you do good padding?