# OAEP Cryptanalysis with broken hash

Keeping OAEP Cryptanalysis in mind, about the inability to get to $M_1$ or $M_2$ given $\operatorname{OAEP}(M_1) \oplus \operatorname{OAEP}(M_2)$.

Would it be possible to get to $M_1$ or $M_2$, given $\operatorname{OAEP}(M_1) \oplus \operatorname{OAEP}(M_2)$, if the underlying hash function $\operatorname{H}$ or MGF $\operatorname{G}$ used in this instance of $\operatorname{OAEP}$ is found to be broken (invertible)?

Thanks.

• Hi, I am talking about an invertible $\operatorname{MGF}$ G and an invertible hash function H, used in $\operatorname{OAEP}$. I understand the second preimage vulnerability you mention, but I am interested in the possiblity of retrieving $M_1$ or $M_2$, given the fact that the $\operatorname{OAEP}$ instance might be broken and the fact that I only have $\operatorname{OAEP}(M_1) \oplus \operatorname{OAEP}(M_2)$. – Ruan Sunkel May 3 '18 at 10:23
• My mention of a second preimage attack for encryption was silly! Thanks for the clarification. – fgrieu May 3 '18 at 10:31
• The assumption is that an adversary somehow got around the encryption, and managed to retrieve $\operatorname{OAEP}(M_1) \oplus \operatorname{OAEP}(M_2)$, and the adversary knows that the padding scheme, $\operatorname{OAEP}$ in this case, is broken, because it was found, as an example, that SHA512 is invertible, for argument sake. – Ruan Sunkel May 3 '18 at 10:32
• Do you know something about M1 and M2, are they both prime numbers of a specific size? – daniel May 3 '18 at 13:03
• $M_1$ and $M_2$ are unknown. – Ruan Sunkel May 3 '18 at 14:01