How RSA-OAEP decrypt a Symmetric Key message?

In an RSA-OAEP encrypted symmetric Key (AES for example) message. The message is then decrypted by the other party when R is a Random Number That other party doesn't know about. so How it can retrieve back the key when it's XORed with A Hash (hash1) That it doesn't know. I don't think that output of Hash2 helps with anything. Right?

• Just reverse the arrows except the hashes. Aug 21, 2020 at 6:11
• well to reach message we will still have to xor with output of hash function ( which is not Known ), what I am asking How message is decrypted back in the real world when R is not known (not sent with message ), or does it get sent with encrypted message in some way Like the IV for symmetric encryption .
– KMG
Aug 21, 2020 at 7:03
• So you got the point. R randomize each encryption even you have the same input. Aug 21, 2020 at 7:06
• @kelalaka Yes of course I know The reason we use a random Number , to prevent same messages to have Same plaintext. I am asking if we hash(R) Then XOr it with Key and send result how we can get key Back if R is NOT Known so we cant compute hash(R) and cant Xor it with Ciphertext to get key back.
– KMG
Aug 21, 2020 at 7:10
• You have the input of Hash2 right? It's in the OAEP padding (P) on the right. So you can perform the XOR on the left, and get R back. Aug 21, 2020 at 7:34

OAEP is Optimal asymmetric encryption padding for RSA and developed by M. Bellare, P. Rogaway, in 1995 and standardized in PKCS#1 v2 and RFC 2437.

Your image hiding some internals of the OAEP. Here a better one;

The MFG is Mask Generation Function is expected to be a random oracle. The MFGs are similar to a cryptographic hash function except that while a standard hash function's output is a fixed size, the MGF supports output of a variable-length.

If OAEP is developed after the XOF (Extendable Output Functions) then the proof will be much easier.

How it can retrieve back the key when it's XORed with A Hash (hash1) That it doesn't know. I don't think that the output of Hash2 helps with anything. Right?

We can formalize above as;

\begin{align} T &= lhash \mathbin\| PS \| \texttt{01} \mathbin\| Message\\ maskedDB &= MFG1(seed) \oplus T \\ maskedSeed &= MFG2(maskedDB) \oplus seed\\ \end{align}

In the PKCS#1 standard, the same MFG is used as the random oracles. I've made a distinction by numbering. $$MFG1$$ is taken the $$seed$$ as input.

Now, you got a message that is sent to you by RSA-OAEP. You get the $$maskedSeed$$ and $$maskedDB$$

The $$seed$$ can be calculated by

$$seed = maskedSeed \oplus maskedDB$$ and now we know the $$seed$$.

Now the $$T$$ can be computed by

$$T = MFG1(seed) \oplus maskedDB$$

Now get the encoded $$message$$ block and check it.

$$T = lhash \mathbin\| PS \| \texttt{01} \mathbin\| Message$$