# RSA-OAEP versus RSA with Fujisaki-Okamoto construction

I was wondering why the Fujisaki-Okamoto construction (or one of its variants) is not (at least commonly) used with RSA to achieve CCA2 security? Does anyone know of any speed comparisons between RSA w/ F-O and RSA-OAEP? Perhaps the reason is simply historical since F-O is newer.

-
Do you have a link to a description of this construction? Looks like I'm too tired now to find it on Google. –  Paŭlo Ebermann Mar 7 '12 at 19:29

What if I use padded RSA by padding with a constant number of random bits? Then if $H_1$ and $H_2$ are two hash functions, $e$ the public exponent, $m$ the message and $r$ a random number, encryption would be $$m \mapsto <(r||H_1(r,m))^e, H_2(r)\oplus m>$$ and this seems to be much easier than OAEP. –  Kim Mar 7 '12 at 23:57