# Tag Info

4

It seems that the authors of Keccak sponge (the algorithm chosen to be SHA-3) do think their SHAKE functions can directly be used for simplifying OAEP and PSS: The introduction of extendable-output functions (or XOFs, pronounced zoff) is a particularly nice feature of the standard. A XOF like SHAKE128 or SHAKE256 can be seen as a generalization of hash ...

4

The first hash is only used to hash the label. Most of the time the label will simply be empty, which means that a constant value can be used, identified just by the hash algorithm itself. Although the hash values may differ and may have any SHA-x value, they are generally set to SHA-1 - which is the default. Note that SHA-1 is considered secure for MGF-1. ...

3

Actually, we don't care about the amount of padding the original message had; we care whether the modified plaintext (that is, the result of the decryption of the modified ciphertext) has good padding or not. The padding will be valid if the last block had one of these patterns: XX XX XX XX XX XX XX 01 XX XX XX XX XX XX 02 02 XX XX XX XX XX 03 ...

1

This article is quite sloppily written... We suppose that the padding is valid, this means that upon decryption of $C_1' + C_2$, the resulting plaintext will be correctly padded. And we want to show that then $P2'[16] = \mathtt{01}$. We can show this by contraposition: with our construction of $C_1'$ as 15 random bytes followed by $\mathtt{00}$, if \$P_2'[16] ...

1

No, RSA encryption does not provide authenticity, regardless of the padding. This is for the simple reason that anybody can encrypt with the public key. This is irrespective of the asymmetric algorithm used. You need to sign the data to obtain authenticity. What AEAD does do is to protect e.g. against padding oracle attacks. These can be performed on CBC ...

Only top voted, non community-wiki answers of a minimum length are eligible