The choice of $n_\text{Len}–K_\text{Len}–2\,H_\text{Len}–2$ zero bytes seems arbitrary to me and I can't see any reasoning for why it was chosen and it doesn't look like the zero bytes being replaced at any point either? Why was this specific formula used? From section of Recommendation for Pair-Wise Key Establishment Using Integer Factorization Cryptography:

b. Construct a byte string $PS$ consisting of $n_\text{Len}–K_\text{Len}–2\,H_\text{Len}–2$ zero bytes. The length of $PS$ may be zero.

c. Concatenate $HA$, $PS$, a single byte with a hexadecimal value of 01, and the keying material $K$ to form data $DB$ of $n_\text{Len}–K_\text{Len}-1$ bytes as follows:

$$ DB = HA \mathbin\| \text{PS} \mathbin\| 00000001 \mathbin\| K,$$ where $00000001$ is a string of eight bits.


1 Answer 1


The choice of $n_\text{Len}–K_\text{Len}–2\,H_\text{Len}–2$ zero bytes seems arbitrary

No. It's actually tight given what RSAES-OAEP does:

  • allow any modulus $n$ of $n_\text{Len}$ bytes,
  • $H_\text{Len}$ bytes for the hash of the tag,
  • $H_\text{Len}$ bytes for an unconstrained random seed,
  • length of the message (that is, the value of $K_\text{Len}$) encoded in the padding.

$n_\text{Len}$ is the number of bytes to represent the modulus $n$, that is $\left\lceil b/8\right\rceil$ where $b$ is the modulus size in bits. An all-ones bitstring encoding a value less than $n$ needs to be $b-1$ bits, thus we can't use more than $n_\text{Len}-1$ bytes for the padded message. From that we need to remove $H_\text{Len}$ for the hash of tag, and $H_\text{Len}$ for the seed. By a counting argument we need at least one bit to encode the length of the message, which is variable and must be encoded into the padding. That one bit has been rounded up to one byte, and that's all the leeway there is to fit the message of $K_\text{Len}$ bytes.

The scheme to encode the length of the message is that the message is left-padded with a bit at 1, then bits at 0 for what remains. Decoding the bit length of the message (equivalently, removing the padding) remains simple. This scheme is maximally compact for long messages: if RSAES-OAEP allowed bit-sized messages, it would allow messages up to $8\,K_\text{Len}+7$ bits. With such allowance, the entire padding (bits at 0 and the bit at 1) would provide nearly no redundancy: over the $n_\text{Len}–2\,H_\text{Len}–1$ bytes used for message an padding, only the all-zero bitstring would be invalid.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.