RSAES-OAEP-DECRYPT (K, C, P)
Input: K recipient’s RSA private key
C ciphertext to be decrypted, an octet string of length k, where k is the length in octets of the modulus n
P encoding parameters, an octet string that may be empty
Output: M message, an octet string of length at most k-2-2hLen, where hLen is the length in octets of the hash function output for EME-OAEP; or “decryption error”
Steps:
1. If the length of the ciphertext C is not k octets, output “decryption error” and stop.
2. Convert the ciphertext C to an integer ciphertext representative c:
c = OS2IP (C)
3. Apply the RSADP decryption primitive (Section 5.1.2) to the private key K and the ciphertext representative c to produce an integer message representative m:
m = RSADP (K, c)
If RSADP outputs “ciphertext out of range,” then output “decryption error” and stop.
4. Convert the message representative m to an encoded message EM of length k-1 octets:
EM = I2OSP (m, k-1)
If I2OSP outputs “integer too large,” then output “decryption error” and stop.
5. Apply the EME-OAEP decoding operation to the encoded message EM and the encoding parameters P to recover a message M:
M = EME-OAEP-DECODE (EM, P)
If the decoding operation outputs “decoding error,” then output “decryption error” and stop.
6. Output the message M.
Note. It is important that the error messages output in steps 4 and 5 be the same, otherwise an adversary may be able to extract useful information from the type of error message received. Error message information is used to mount a chosen ciphertext attack on PKCS #1 v1.5 encrypted messages in [4].