Keeping OAEP Cryptanalysis in mind, about the inability to get to $M_1$ or $M_2$ given $\operatorname{OAEP}(M_1) \oplus \operatorname{OAEP}(M_2)$.

Would it be possible to get to $M_1$ or $M_2$, given $\operatorname{OAEP}(M_1) \oplus \operatorname{OAEP}(M_2)$, if the underlying hash function $\operatorname{H}$ or MGF $\operatorname{G}$ used in this instance of $\operatorname{OAEP}$ is found to be broken (invertible)?


  • $\begingroup$ Hi, I am talking about an invertible $\operatorname{MGF}$ G and an invertible hash function H, used in $\operatorname{OAEP}$. I understand the second preimage vulnerability you mention, but I am interested in the possiblity of retrieving $M_1$ or $M_2$, given the fact that the $\operatorname{OAEP}$ instance might be broken and the fact that I only have $\operatorname{OAEP}(M_1) \oplus \operatorname{OAEP}(M_2)$. $\endgroup$ – Ruan Sunkel May 3 '18 at 10:23
  • $\begingroup$ My mention of a second preimage attack for encryption was silly! Thanks for the clarification. $\endgroup$ – fgrieu May 3 '18 at 10:31
  • $\begingroup$ The assumption is that an adversary somehow got around the encryption, and managed to retrieve $\operatorname{OAEP}(M_1) \oplus \operatorname{OAEP}(M_2)$, and the adversary knows that the padding scheme, $\operatorname{OAEP}$ in this case, is broken, because it was found, as an example, that SHA512 is invertible, for argument sake. $\endgroup$ – Ruan Sunkel May 3 '18 at 10:32
  • $\begingroup$ Do you know something about M1 and M2, are they both prime numbers of a specific size? $\endgroup$ – daniel May 3 '18 at 13:03
  • $\begingroup$ $M_1$ and $M_2$ are unknown. $\endgroup$ – Ruan Sunkel May 3 '18 at 14:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.