Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Given nothing more than some integer $m =$ OAEP($M$), is it possible to recover the original plaintext $M$? In other words, without being given the hash functions or the random string used for encoding, or even the length of it.

EDIT: This is being used in tandem with RSA, but I don't know the hash functions that OAEP usually uses with RSA; they might be public, for all I know.

share|improve this question
Why would the hash-functions be unknown? Those should usually be considered public information. –  Maeher Apr 27 '13 at 20:22
Does OAEP use certain standard hash functions when RSA is used (edited question to reflect that this is being used with RSA). –  luolimao Apr 27 '13 at 23:07
there's a limited set of hash functions that can be used (i.e. are expected to be secure enough to be used), just iterated over them –  ratchet freak Apr 28 '13 at 0:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.