Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I can't understand how the "cryptographic functions" are to be selected RSA + OAEP which are used in OAEP. How to choose these "cryptographic functions"(G and H)?

enter image description here

share|improve this question

Since this picture is taken from wikipedia, I suggest reading the text beside that picture:

  • G and H are typically some cryptographic hash functions fixed by the protocol.

I think you're asking how OAEP and RSA actually are combined, and it goes like this:

  • Use OAEP (choose $r$, follow the instructions and you get $X$ and $Y$)
  • Concatenate $X$ and $Y$, interpret it as an integer (length has to be lower than the RSA keylength)
  • Use this number in RSA.

For decryption, reverse the process.

share|improve this answer
Wikipaedia says "G and H are typically some cryptographic hash functions fixed by the protocol.". I don't understand it. – Sahil Sareen Mar 14 '14 at 12:36
I assume you know what cryptographic hash functions are (wikipedia), but there are quite a lot of them. And which one is chosen is up to the protocol designer. For example, RFC 3447 describes RSA-OAEP, but they didn't fix a hash function either but leave it as an optional parameter. That means in practice, you use e.g. RSA-OAEP with SHA-256. – tylo Mar 14 '14 at 13:24

Both PKCS#1 v2.1 and RFC 3447 define OAEP in quite a different way. In the graphic used on Wikipedia a lot of things are missing (for instance the label and the exact sizes of the fields).

To answer your question: The cryptographic functions G and H both are typically the function mgf1 (mask generating function) with SHA1 as defined by RFC 3447.

Pseudocode for mgf1 with SHA1:

function mgf1(bytearray seed, int length) {
  // 20 is the length of a sha1 hash.
  numBlocks := (length / 20).ceil
  blocks := new byte[]
  for(int i = 0; i < numBlocks; i++) {
    blocks.append(sha1(seed ++ int2BigEndianBytes(i)))
  return blocks.slice(0, length)

I still strongly suggest you read the PKCS#1. On page 19 you can find a complete graphical representation of OAEP.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.