# Selection of cryptographic functions for OAEP

I can't understand how the "cryptographic functions" are to be selected RSA + OAEP which are used in OAEP. How to choose these "cryptographic functions"(G and H)?

• I think it was unfair that this was downvoted as much; Wikipedia's article is simply entirely wrong. G and H cannot be cryptographic hashes if they are used to extract or expand the seed etc. They should be Mask Generation Functions (MGF's) and currently there is only one defined: MGF1, which can indeed be configured using a cryptographic hash. MGF's are completely missing from Wikipedia, even after almost 5 years since the question. Feb 23, 2019 at 2:31

## 2 Answers

Both PKCS#1 v2.1 and RFC 3447 define OAEP in quite a different way. In the graphic used on Wikipedia a lot of things are missing (for instance the label and the exact sizes of the fields).

To answer your question: The cryptographic functions G and H both are typically the function mgf1 (mask generating function) with SHA1 as defined by RFC 3447.

Pseudocode for mgf1 with SHA1:

function mgf1(bytearray seed, int length) {
// 20 is the length of a sha1 hash.
numBlocks := (length / 20).ceil
blocks := new byte[]
for(int i = 0; i < numBlocks; i++) {
blocks.append(sha1(seed ++ int2BigEndianBytes(i)))
}
return blocks.slice(0, length)
}


I still strongly suggest you read the PKCS#1. On page 19 you can find a complete graphical representation of OAEP.

Since this picture is taken from wikipedia, I suggest reading the text beside that picture:

• G and H are typically some cryptographic hash functions fixed by the protocol.

I think you're asking how OAEP and RSA actually are combined, and it goes like this:

• Use OAEP (choose $r$, follow the instructions and you get $X$ and $Y$)
• Concatenate $X$ and $Y$, interpret it as an integer (length has to be lower than the RSA keylength)
• Use this number in RSA.

For decryption, reverse the process.

• Wikipaedia says "G and H are typically some cryptographic hash functions fixed by the protocol.". I don't understand it. Mar 14, 2014 at 12:36
• I assume you know what cryptographic hash functions are (wikipedia), but there are quite a lot of them. And which one is chosen is up to the protocol designer. For example, RFC 3447 describes RSA-OAEP, but they didn't fix a hash function either but leave it as an optional parameter. That means in practice, you use e.g. RSA-OAEP with SHA-256.
– tylo
Mar 14, 2014 at 13:24