The safe way to encrypt with RSA: add randomness and structure so encrypted messages can't be guessed or tampered with.
The idea: Textbook RSA is deterministic: the same message always encrypts the same way, so an attacker can encrypt guesses ("yes", "no") and compare. It is also malleable: multiplying a ciphertext changes the hidden message in a predictable way. OAEP fixes both by mixing the message with fresh random bits, through two hash functions, before the RSA step. Every encryption now looks different, and a tampered ciphertext unpacks into garbage that gets rejected.
Why it matters: RSA encryption without it has been broken in practice again and again.
The details
RSA encryption with OAEP padding[1], which randomizes each message and prevents tampering with ciphertexts. It is proven secure assuming the RSA problem is hard and the hash functions behave like random oracles (the ROM tag)[2].
The older PKCS#1 v1.5 encryption padding fell to Bleichenbacher's attack (1998)[3], which keeps resurfacing (ROBOT, 2017)[4]. TLS 1.3 dropped RSA key transport altogether in favor of Diffie-Hellman with forward secrecy[5].
Nothing on the map depends on it: it is an end point, something people use directly.
About the tags
ROM
Its security proof treats a hash function as a perfectly random function (the random oracle model). Real hashes aren't random functions, so this is a heuristic. For signatures and encryption no practical attack has exploited it. For multi-round proof systems, see the Fiat-Shamir box.
References
Mihir Bellare and Phillip Rogaway. Optimal asymmetric encryption. Advances in Cryptology — EUROCRYPT'94, 1994. doi:10.1007/bfb0053428
Eiichiro Fujisaki, Tatsuaki Okamoto, David Pointcheval and Jacques Stern. RSA-OAEP Is Secure under the RSA Assumption. Journal of Cryptology, 2004. doi:10.1007/s00145-002-0204-y
Daniel Bleichenbacher. Chosen ciphertext attacks against protocols based on the RSA encryption standard PKCS #1. Advances in Cryptology — CRYPTO '98, 1998. doi:10.1007/bfb0055716