Given nothing more than some integer $m =$ OAEP($M$), is it possible to recover the original plaintext $M$? In other words, without being given the hash functions or the random string used for encoding, or even the length of it.

EDIT: This is being used in tandem with RSA, but I don't know the hash functions that OAEP usually uses with RSA; they might be public, for all I know.

  • 2
    $\begingroup$ Why would the hash-functions be unknown? Those should usually be considered public information. $\endgroup$
    – Maeher
    Apr 27, 2013 at 20:22
  • $\begingroup$ Does OAEP use certain standard hash functions when RSA is used (edited question to reflect that this is being used with RSA). $\endgroup$ Apr 27, 2013 at 23:07
  • 1
    $\begingroup$ there's a limited set of hash functions that can be used (i.e. are expected to be secure enough to be used), just iterated over them $\endgroup$ Apr 28, 2013 at 0:04

1 Answer 1


If you know the hash functions, yes. If the hash functions are secret, no—but how would you come into a situation where OAEP is being used with a secret hash function?

For any hash functions $G$ and $H$, OAEP is a fixed permutation involving no secret keys. Specifically, given a message $m$ and randomization $r$, OAEP returns $(a, b)$ where

\begin{align} a &= m \oplus G(r), \\ b &= r \oplus H(a), \end{align}

which can be inverted by

\begin{align} r &= b \oplus H(a), \\ m &= a \oplus G(r). \end{align}

So if you have $(a, b)$ and you can compute $G$ and $H$, you can recover $m$ (and $r$). This is exactly what RSAES-OAEP decryption does, after it completes the RSA private key operation.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.