-1
$\begingroup$

I can't understand how the "cryptographic functions" are to be selected RSA + OAEP which are used in OAEP. How to choose these "cryptographic functions"(G and H)?

enter image description here

Improve this question
$\endgroup$
  • 1
    $\begingroup$ I think it was unfair that this was downvoted as much; Wikipedia's article is simply entirely wrong. G and H cannot be cryptographic hashes if they are used to extract or expand the seed etc. They should be Mask Generation Functions (MGF's) and currently there is only one defined: MGF1, which can indeed be configured using a cryptographic hash. MGF's are completely missing from Wikipedia, even after almost 5 years since the question. $\endgroup$ – Maarten Bodewes♦ Feb 23 '19 at 2:31
4
$\begingroup$

Both PKCS#1 v2.1 and RFC 3447 define OAEP in quite a different way. In the graphic used on Wikipedia a lot of things are missing (for instance the label and the exact sizes of the fields).

To answer your question: The cryptographic functions G and H both are typically the function mgf1 (mask generating function) with SHA1 as defined by RFC 3447.

Pseudocode for mgf1 with SHA1:

function mgf1(bytearray seed, int length) {
  // 20 is the length of a sha1 hash.
  numBlocks := (length / 20).ceil
  blocks := new byte[]
  for(int i = 0; i < numBlocks; i++) {
    blocks.append(sha1(seed ++ int2BigEndianBytes(i)))
  }
  return blocks.slice(0, length)
}

I still strongly suggest you read the PKCS#1. On page 19 you can find a complete graphical representation of OAEP.

Improve this answer
$\endgroup$
1
$\begingroup$

Since this picture is taken from wikipedia, I suggest reading the text beside that picture:

  • G and H are typically some cryptographic hash functions fixed by the protocol.

I think you're asking how OAEP and RSA actually are combined, and it goes like this:

  • Use OAEP (choose $r$, follow the instructions and you get $X$ and $Y$)
  • Concatenate $X$ and $Y$, interpret it as an integer (length has to be lower than the RSA keylength)
  • Use this number in RSA.

For decryption, reverse the process.

Improve this answer
$\endgroup$
  • $\begingroup$ Wikipaedia says "G and H are typically some cryptographic hash functions fixed by the protocol.". I don't understand it. $\endgroup$ – Sahil Sareen Mar 14 '14 at 12:36
  • $\begingroup$ I assume you know what cryptographic hash functions are (wikipedia), but there are quite a lot of them. And which one is chosen is up to the protocol designer. For example, RFC 3447 describes RSA-OAEP, but they didn't fix a hash function either but leave it as an optional parameter. That means in practice, you use e.g. RSA-OAEP with SHA-256. $\endgroup$ – tylo Mar 14 '14 at 13:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.