Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Given nothing more than some integer $m =$ OAEP($M$), is it possible to recover the original plaintext $M$? In other words, without being given the hash functions or the random string used for encoding, or even the length of it.

EDIT: This is being used in tandem with RSA, but I don't know the hash functions that OAEP usually uses with RSA; they might be public, for all I know.

share|improve this question
Why would the hash-functions be unknown? Those should usually be considered public information. – Maeher Apr 27 '13 at 20:22
Does OAEP use certain standard hash functions when RSA is used (edited question to reflect that this is being used with RSA). – luolimao Apr 27 '13 at 23:07
there's a limited set of hash functions that can be used (i.e. are expected to be secure enough to be used), just iterated over them – ratchet freak Apr 28 '13 at 0:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.