Given nothing more than some integer $m =$ OAEP($M$), is it possible to recover the original plaintext $M$? In other words, without being given the hash functions or the random string used for encoding, or even the length of it.

EDIT: This is being used in tandem with RSA, but I don't know the hash functions that OAEP usually uses with RSA; they might be public, for all I know.

  • 2
    $\begingroup$ Why would the hash-functions be unknown? Those should usually be considered public information. $\endgroup$ – Maeher Apr 27 '13 at 20:22
  • $\begingroup$ Does OAEP use certain standard hash functions when RSA is used (edited question to reflect that this is being used with RSA). $\endgroup$ – éclairevoyant Apr 27 '13 at 23:07
  • 1
    $\begingroup$ there's a limited set of hash functions that can be used (i.e. are expected to be secure enough to be used), just iterated over them $\endgroup$ – ratchet freak Apr 28 '13 at 0:04

If you know the hash functions, yes. If the hash functions are secret, no—but how would you come into a situation where OAEP is being used with a secret hash function?

For any hash functions $G$ and $H$, OAEP is a fixed permutation involving no secret keys. Specifically, given a message $m$ and randomization $r$, OAEP returns $(a, b)$ where

\begin{align} a &= m \oplus G(r), \\ b &= r \oplus H(a), \end{align}

which can be inverted by

\begin{align} r &= b \oplus H(a), \\ m &= a \oplus G(r). \end{align}

So if you have $(a, b)$ and you can compute $G$ and $H$, you can recover $m$ (and $r$). This is exactly what RSAES-OAEP decryption does, after it completes the RSA private key operation.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.