1
$\begingroup$

im looking at wiki at the moment as how to use oeap padding and it appears, help me out if im wrong as G(r) - expands r to the size of the padded message, I am then limited by the size of my hash function as say a SHA-256 hash function would expand to only 256 bits, but what if I had a 2048 bit modulus? I'm unsure if there are any 2000+bit hash functions out there, or could I use a series of different r values, hash them and use the concatenation of the hash outputs to create a 2000 bit xor?

$\endgroup$
3
  • $\begingroup$ Effectively same question as crypto.stackexchange.com/questions/14995/… although the better answer there crypto.stackexchange.com/a/22645/12642 is lower-voted. In short G and H aren't just a hash, but a slightly more complicated iterated hash called Mask Generation Function defined in PKCS1/rfc2437/rfc3447. $\endgroup$ Dec 2 '15 at 23:35
  • $\begingroup$ @dave_thompson_085, would you mind giving a complete answer here? $\endgroup$
    – SEJPM
    Dec 3 '15 at 22:04
  • $\begingroup$ Wow, I just looked at the Wikipedia description of OAEP and it is completely and utterly wrong. I mean, it doesn't even have MGF1 in there... Oh, that's indeed also in the other Q/A... Hmm. $\endgroup$
    – Maarten Bodewes
    Feb 23 '19 at 2:18