Optimal asymmetric encryption padding: Difference between revisions

Revision as of 02:23, 29 September 2008

Revision as of 16:44, 17 October 2008

Line 24:

In the diagram,

* ''n'' is the number of bits in the RSA modulus.

* k0''k''₀ and k1''k''₁ are integers fixed by the protocol.

* ''m'' is the plaintext message, a (''n''&nbsp;&minus;&nbsp;''k''</sub>0</sub>&nbsp;&minus;&nbsp;''k''₁ )- k0 - k1 bit string

* ''G'' and ''H'' are typically some [[cryptographic hash function]]s fixed by the protocol.

To encode,

# messages are padded with k1''k''₁ zeros to be ''n - k0''&nbsp;&minus;&nbsp;''k''₀ bits in length.

# ''r'' is a random k0''k''₀ bit string

# ''G'' expands the k0''k''₀ bits of ''r'' to ''n - k0''&nbsp;&minus;&nbsp;''k''₀ bits.

# ''X'' = m00''m''00..0 &oplus; ''G''(''r'')

# ''H'' reduces the ''n - k0''&nbsp;&minus;&nbsp;''k''₀ bits of ''X'' to k0''k''₀ bits.

# ''Y'' = ''r'' &oplus; ''H''(''X'')

# The output is ''X'' || ''Y'' where ''X'' is shown in the diagram as the leftmost block and ''Y'' as the rightmost block.

To decode,

# recover the random string as ''r'' = ''Y'' &oplus; ''H''(''X'')

# recover the message as m00''m''00..0 = ''X'' &oplus; ''G''(''r'')

==References==