# Is OAEP reversible?

Given nothing more than some integer $m =$ OAEP($M$), is it possible to recover the original plaintext $M$? In other words, without being given the hash functions or the random string used for encoding, or even the length of it.

EDIT: This is being used in tandem with RSA, but I don't know the hash functions that OAEP usually uses with RSA; they might be public, for all I know.

• Why would the hash-functions be unknown? Those should usually be considered public information. – Maeher Apr 27 '13 at 20:22
• Does OAEP use certain standard hash functions when RSA is used (edited question to reflect that this is being used with RSA). – éclairevoyant Apr 27 '13 at 23:07
• there's a limited set of hash functions that can be used (i.e. are expected to be secure enough to be used), just iterated over them – ratchet freak Apr 28 '13 at 0:04

For any hash functions $$G$$ and $$H$$, OAEP is a fixed permutation involving no secret keys. Specifically, given a message $$m$$ and randomization $$r$$, OAEP returns $$(a, b)$$ where
\begin{align} a &= m \oplus G(r), \\ b &= r \oplus H(a), \end{align}
\begin{align} r &= b \oplus H(a), \\ m &= a \oplus G(r). \end{align}
So if you have $$(a, b)$$ and you can compute $$G$$ and $$H$$, you can recover $$m$$ (and $$r$$). This is exactly what RSAES-OAEP decryption does, after it completes the RSA private key operation.