6
$\begingroup$

I was looking at this image about OAEP:

enter image description here

..and was wondering what was happening here.

  1. We have a data block DB which consists of:

    • lHash: What is this and where does this come from?
    • PS: A string of zeros, but how much zeros?
    • M: clearly our message.

  2. We have a seed which , is some random number. We put this seed into a MGF, a Mask Generating Function, and XOR the outcome with the MB. This is our maskedDB. Correct?

  3. We put the maskedDB to the MGF again and XOR it with the seed. This is our maskedSeed.

  4. For the final EM (encrypted message) we prepend some zeros. What do we do with EM then?

Improve this question
$\endgroup$
2
  • $\begingroup$ WTF! OAEP only uses a two round Feistel network?! That's not even enough to be a random permutation (requires 3 rounds) let alone a strong random permutation (requires 4 rounds). $\endgroup$
    – CodesInChaos
    Commented Jan 28, 2016 at 19:07
  • 3
    $\begingroup$ @CodesInChaos OAEP is a padding scheme, not an encryption algorithm. Its output is random enough for that. $\endgroup$
    – mat
    Commented Apr 3, 2017 at 19:26

1 Answer 1

Reset to default
6
$\begingroup$

1a lHash: What is this and where does this come from?

That's in PKCS#1 v2.1: RSAES-OAEP-ENCRYPT ((n, e), M, L):

2a. If the label L is not provided, let L be the empty string. Let lHash = Hash(L), an octet string of length hLen (see the note below).

1b) PS: A string of zeros, but how much zeros?

Similarly for this question, lets look at the actual standard:

2b. Generate an octet string PS consisting of k - mLen - 2hLen - 2 zero octets. The length of PS may be zero.

2) We have a seed which , is some random number. We put this seed into a MGF, a Mask Generating Function, and XOR the outcome with the MB. This is our maskedDB. Correct?

Well, yes, but you XOR with DB, not with MB (whatever that is). It's in steps 2c..2f of the linked section of PKCS#1.

3) We put the maskedDB to the MGF again and XOR it with the seed. This is our maskedSeed.

4) For the final EM (encrypted message) we prepend some zeros. What do we do with EM then?

You continue with steps 3a..c and of course step 4 of the standard, which basically means:

  • 3a) creating an integer from the octet string you've just constructed
  • 3b) modular exponentiation with the public exponent and modulus of the public key (also known as raw or textbook RSA)
  • 3c) creating an octet string from the result again

And 4, output the result (well...duh).

Improve this answer
$\endgroup$
3
  • $\begingroup$ ...the EM is given to the standard RSA? $\endgroup$
    – 今天春天
    Commented Jan 28, 2016 at 17:33
  • 1
    $\begingroup$ @今天春天: yes, except that what you call "standard RSA" is hardly standardized (though close to PKCS#1v1.5 format 0), and usually is called textbook RSA encryption, RSA encryption with no padding, (textbook|raw|bare|naked) RSA public-key|encryption primitive|function. More strictly speaking, RSA Encryption Primitive , noted RSAEP, is step 3b). $\endgroup$
    – fgrieu ♦
    Commented Jan 28, 2016 at 18:52
  • $\begingroup$ seed length equals hLen, the result of hashing seed is something its length depends on hash algorithm (sha1: 20 bytes, sha256: 32 bytes...). how it can be k - hLen - 1 as PKCS#1 said? $\endgroup$
    – Bao HQ
    Commented Jan 29, 2018 at 8:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.