Keeping OAEP Cryptanalysis in mind, about the inability to get to $M_1$ or $M_2$ given $\operatorname{OAEP}(M_1) \oplus \operatorname{OAEP}(M_2)$.

Would it be possible to get to $M_1$ or $M_2$, given $\operatorname{OAEP}(M_1) \oplus \operatorname{OAEP}(M_2)$, if the underlying hash function $\operatorname{H}$ or MGF $\operatorname{G}$ used in this instance of $\operatorname{OAEP}$ is found to be broken (invertible)?


  • $\begingroup$ Hi, I am talking about an invertible $\operatorname{MGF}$ G and an invertible hash function H, used in $\operatorname{OAEP}$. I understand the second preimage vulnerability you mention, but I am interested in the possiblity of retrieving $M_1$ or $M_2$, given the fact that the $\operatorname{OAEP}$ instance might be broken and the fact that I only have $\operatorname{OAEP}(M_1) \oplus \operatorname{OAEP}(M_2)$. $\endgroup$ May 3, 2018 at 10:23
  • $\begingroup$ My mention of a second preimage attack for encryption was silly! Thanks for the clarification. $\endgroup$
    – fgrieu
    May 3, 2018 at 10:31
  • $\begingroup$ The assumption is that an adversary somehow got around the encryption, and managed to retrieve $\operatorname{OAEP}(M_1) \oplus \operatorname{OAEP}(M_2)$, and the adversary knows that the padding scheme, $\operatorname{OAEP}$ in this case, is broken, because it was found, as an example, that SHA512 is invertible, for argument sake. $\endgroup$ May 3, 2018 at 10:32
  • $\begingroup$ Do you know something about M1 and M2, are they both prime numbers of a specific size? $\endgroup$
    – daniel
    May 3, 2018 at 13:03
  • $\begingroup$ $M_1$ and $M_2$ are unknown. $\endgroup$ May 3, 2018 at 14:01


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.