# Recover message in RSA-OAEP with fixed seed

In RSA-OAEP given a fixed and a known value for the seed, is it possible to recover message using its ciphertext and the public key $$(n,e)$$?

• Hint: in textbook RSA where ciphertext for encryption of $m$ is $m^e\bmod n$, if you know the ciphertext and $(n,e)$, and that $m$ belongs to a small set (e.g. $m$ is one of the names on the class roll converted to integer per some known convention, and you have the class roll), what is a straightforward method to find $m$ ? Can this be extended to the case at hand ? RSAES-OAEP encryption is defined there, with seed appearing at step 2d. – fgrieu Dec 1 at 7:11
• based on RFC-8017 Page. 23, if you know the seed, you just know a part of the maskedDB. MaskedSeed is the challenging part because its value is depend on the output of MGF(maskedSeed). Since the MGF(.) is based on a hash function, say SHA-1, the output of MGF(x) is depend on all bits of x. So, we just know a few bits of message and the set of all candidates messages is not small. – H.S Dec 2 at 12:33
• Not the right line of thought. Notice that if you know seed (and $L$, conventionally empty unless stated otherwise), then $\mathrm{EM}$ becomes a function of $M$. Hence $m$ becomes a function of $M$. Hence the attack that I hint for textbook RSA can be performed. It works for small message space (as often found in practice, e.g. credit card number). For large plaintext space, that's still a working "chosen plaintext" attack (as part of the original question, but removed by @kelalaka). – fgrieu Dec 2 at 12:46