More importantly, Rabin would be used in a hybrid cryptosystem, including message authentication codes, so you could calculate MACs using all 4 possible keys.

More importantly, Rabin would be used in a hybrid cryptosystem, including message authentication codes, so you could calculate MACs using all 4 possible keys. Though, it would be much lower overhead and safer to use OAEP[0] to encode the symmetric cipher/MAC key(s) and then encrypt with Rabin. There's very low probability that more than one of the 4 possible plaintexts has all zeroes for padding after OAEP decoding. [0] https://en.wikipedia.org/wiki/Optimal_asymmetric_encryption_padding https://en.wikipedia.org/wiki/Optimal_asymmetric_encryption_...