# RSA-OAEP: How does it work?

I was looking at this image about OAEP:

..and was wondering what was happening here.

1. We have a data block DB which consists of:

• lHash: What is this and where does this come from?
• PS: A string of zeros, but how much zeros?
• M: clearly our message.
2. We have a seed which , is some random number. We put this seed into a MGF, a Mask Generating Function, and XOR the outcome with the MB. This is our maskedDB. Correct?

3. We put the maskedDB to the MGF again and XOR it with the seed. This is our maskedSeed.

4. For the final EM (encrypted message) we prepend some zeros. What do we do with EM then?

• WTF! OAEP only uses a two round Feistel network?! That's not even enough to be a random permutation (requires 3 rounds) let alone a strong random permutation (requires 4 rounds). Jan 28 '16 at 19:07
• @CodesInChaos OAEP is a padding scheme, not an encryption algorithm. Its output is random enough for that.
– mat
Apr 3 '17 at 19:26

## 1 Answer

1a lHash: What is this and where does this come from?

2a. If the label L is not provided, let L be the empty string. Let lHash = Hash(L), an octet string of length hLen (see the note below).

1b) PS: A string of zeros, but how much zeros?

Similarly for this question, lets look at the actual standard:

2b. Generate an octet string PS consisting of k - mLen - 2hLen - 2 zero octets. The length of PS may be zero.

2) We have a seed which , is some random number. We put this seed into a MGF, a Mask Generating Function, and XOR the outcome with the MB. This is our maskedDB. Correct?

Well, yes, but you XOR with DB, not with MB (whatever that is). It's in steps 2c..2f of the linked section of PKCS#1.

3) We put the maskedDB to the MGF again and XOR it with the seed. This is our maskedSeed.

4) For the final EM (encrypted message) we prepend some zeros. What do we do with EM then?

You continue with steps 3a..c and of course step 4 of the standard, which basically means:

• 3a) creating an integer from the octet string you've just constructed
• 3b) modular exponentiation with the public exponent and modulus of the public key (also known as raw or textbook RSA)
• 3c) creating an octet string from the result again

And 4, output the result (well...duh).

• ...the EM is given to the standard RSA? Jan 28 '16 at 17:33
• @今天春天: yes, except that what you call "standard RSA" is hardly standardized (though close to PKCS#1v1.5 format 0), and usually is called textbook RSA encryption, RSA encryption with no padding, (textbook|raw|bare|naked) RSA public-key|encryption primitive|function. More strictly speaking, RSA Encryption Primitive , noted RSAEP, is step 3b).
– fgrieu
Jan 28 '16 at 18:52
• seed length equals hLen, the result of hashing seed is something its length depends on hash algorithm (sha1: 20 bytes, sha256: 32 bytes...). how it can be k - hLen - 1 as PKCS#1 said? Jan 29 '18 at 8:09