I am using OAEP in a project and I want the resulting number of bits (n) to be 288 bits. Most of the implementations online seem to be for 1024 bits and using SHA-256 and I was wondering if truncating the number of bits in the G and H functions and then xoring would result in any security issues such as an increased probability for a collision to occur.

Edit: So in my example, n = 288, k0 = 72. For r, I am using a system random generator from the python library: SystemRandom().getrandbits(k0BitsInt)


Here is my implementation, a bit messy and uses Sagemath because I want to encrypt using finite fields. But the padding should look the same.

Could you help me with this. Thanks

  • $\begingroup$ What are the consequences of removing a single byte from a sha256 hash? might help you about truncating a hash function. $\endgroup$
    – kelalaka
    Jan 28, 2019 at 18:47
  • $\begingroup$ It is not RSA, it is a different encryption mechanism that I am looking through for my dissertation and it generates a 288 bits encrypted message $\endgroup$
    – Toncu Vlad
    Jan 28, 2019 at 18:55
  • $\begingroup$ So in my example, n = 288, k0 = 72. For r, I am using a system random generator from the python library: SystemRandom().getrandbits(k0BitsInt). Is there anything more that you would like? I also have some code that I will edit in the main question. $\endgroup$
    – Toncu Vlad
    Jan 28, 2019 at 19:07
  • 1
    $\begingroup$ I think the answer really depends on your encryption scheme. Wait for some other responses. $\endgroup$
    – kelalaka
    Jan 28, 2019 at 19:23
  • 2
    $\begingroup$ I've used OAEP within ECC / ElGamal using a truncated hash before. However, I'm not sure about the XOR you are proposing and I'm afraid that just reading the code may trick me into overlooking some possible details. Could you describe your method more formally? P.S. if you are trying to use OAEP with ECC you are obviously not the first, no need to keep that secret. The initial paper on OAEP was pretty generic as well, actually proving it to be secure with RSA proved harder than the generic case, if I remember correctly. $\endgroup$
    – Maarten Bodewes
    Jan 29, 2019 at 1:30


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.