In an RSA-OAEP encrypted symmetric Key (AES for example) message. The message is then decrypted by the other party when R is a Random Number That other party doesn't know about. so How it can retrieve back the key when it's XORed with A Hash (hash1) That it doesn't know. I don't think that output of Hash2 helps with anything. Right? RSA_OAEP Padded Message

  • 2
    $\begingroup$ Just reverse the arrows except the hashes. $\endgroup$
    – kelalaka
    Aug 21, 2020 at 6:11
  • $\begingroup$ well to reach message we will still have to xor with output of hash function ( which is not Known ), what I am asking How message is decrypted back in the real world when R is not known (not sent with message ), or does it get sent with encrypted message in some way Like the IV for symmetric encryption . $\endgroup$
    – KMG
    Aug 21, 2020 at 7:03
  • $\begingroup$ So you got the point. R randomize each encryption even you have the same input. $\endgroup$
    – kelalaka
    Aug 21, 2020 at 7:06
  • $\begingroup$ @kelalaka Yes of course I know The reason we use a random Number , to prevent same messages to have Same plaintext. I am asking if we hash(R) Then XOr it with Key and send result how we can get key Back if R is NOT Known so we cant compute hash(R) and cant Xor it with Ciphertext to get key back. $\endgroup$
    – KMG
    Aug 21, 2020 at 7:10
  • 2
    $\begingroup$ You have the input of Hash2 right? It's in the OAEP padding (P) on the right. So you can perform the XOR on the left, and get R back. $\endgroup$
    – Maarten Bodewes
    Aug 21, 2020 at 7:34

1 Answer 1


OAEP is Optimal asymmetric encryption padding for RSA and developed by M. Bellare, P. Rogaway, in 1995 and standardized in PKCS#1 v2 and RFC 2437.

Your image hiding some internals of the OAEP. Here a better one;

enter image description here

The MFG is Mask Generation Function is expected to be a random oracle. The MFGs are similar to a cryptographic hash function except that while a standard hash function's output is a fixed size, the MGF supports output of a variable-length.

If OAEP is developed after the XOF (Extendable Output Functions) then the proof will be much easier.

Back to your question

How it can retrieve back the key when it's XORed with A Hash (hash1) That it doesn't know. I don't think that the output of Hash2 helps with anything. Right?

We can formalize above as;

\begin{align} T &= lhash \mathbin\| PS \| \texttt{01} \mathbin\| Message\\ maskedDB &= MFG1(seed) \oplus T \\ maskedSeed &= MFG2(maskedDB) \oplus seed\\ \end{align}

In the PKCS#1 standard, the same MFG is used as the random oracles. I've made a distinction by numbering. $MFG1$ is taken the $seed$ as input.

Now, you got a message that is sent to you by RSA-OAEP. You get the $maskedSeed$ and $maskedDB$

The $seed$ can be calculated by

$$seed = maskedSeed \oplus maskedDB$$ and now we know the $seed$.

Now the $T$ can be computed by

$$ T = MFG1(seed) \oplus maskedDB $$

Now get the encoded $message$ block and check it.

$$T = lhash \mathbin\| PS \| \texttt{01} \mathbin\| Message$$


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.