ebab7d0da53c51438720d60c6e2e467c - /page/wikibook/entry.mu

<!DOCTYPE html>

<title>Mask generation function</title>

</head>

Mask generation function

</h1>

</header>

A mask generation function (MGF) is a cryptographic primitive similar to a <a href="Cryptographic_hash_function" title="Cryptographic hash function">cryptographic hash function</a> except that while a hash function's output has a fixed size, a MGF supports output of a variable length. In this respect, a MGF can be viewed as a <a href="Extendable-output_function" title="Extendable-output function">extendable-output function</a> (XOF): it can accept input of any length and process it to produce output of any length. Mask generation functions are completely deterministic: for any given input and any desired output length the output is always the same.

<div class="mw-heading mw-heading2"><h2 id="Definition">Definition</h2></div>

A mask generation function takes an octet string of variable length and a desired output length as input, and outputs an octet string of the desired length. There may be restrictions on the length of the input and output octet strings, but such bounds are generally very large. Mask generation functions are deterministic; the octet string output is completely determined by the input octet string. The output of a mask generation function should be pseudorandom, that is, if the seed to the function is unknown, it should be infeasible to distinguish the output from a truly random string.<a href="#cite_note-rsa-1">[1]</a>

</blockquote>

<div class="mw-heading mw-heading2"><h2 id="Applications">Applications</h2></div>

Mask generation functions, as generalizations of hash functions, are useful wherever hash functions are. However, use of a MGF is desirable in cases where a fixed-size hash would be inadequate. Examples include generating <a href="Padding_(cryptography)" title="Padding (cryptography)">padding</a>, producing <a href="One-time_pad" title="One-time pad">one-time pads</a> or <a href="Keystream" title="Keystream">keystreams</a> in <a href="Symmetric-key_algorithm" title="Symmetric-key algorithm">symmetric-key encryption</a>, and yielding outputs for <a href="Pseudorandom_number_generator" title="Pseudorandom number generator">pseudorandom number generators</a>.

<div class="mw-heading mw-heading3"><h3 id="Padding_schemes">Padding schemes</h3></div>

Mask generation functions were first proposed as part of the specification for padding in the <a href="Optimal_asymmetric_encryption_padding" title="Optimal asymmetric encryption padding">RSA-OAEP</a> algorithm. The OAEP algorithm required a cryptographic hash function that could generate an output equal in size to a "data block" whose length was proportional to arbitrarily sized input message.<a href="#cite_note-rsa-1">[1]</a>

<div class="mw-heading mw-heading3"><h3 id="Random_number_generators">Random number generators</h3></div>

NIST Special Publication 800-90A<a href="#cite_note-2">[2]</a> defines a class of cryptographically secure random number generators, one of which is the "Hash DRBG", which uses a hash function with a counter to produce a requested sequence of random bits equal in size to the requested number of random bits.

<div class="mw-heading mw-heading2"><h2 id="Examples">Examples</h2></div>

Perhaps the most common and straightforward mechanism to build a MGF is to iteratively apply a hash function together with an incrementing counter value. The counter may be incremented indefinitely to yield new output blocks until a sufficient amount of output is collected. This is the approach used in MGF1.

MGF1 is a mask generation function defined in the Public Key Cryptography Standard #1 published by RSA Laboratories:<a href="#cite_note-rsa-1">[1]</a>

<div class="mw-heading mw-heading4"><h4 id="Options">Options</h4></div>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle {\mathsf {Hash}}}</annotation>

</semantics>

</math><img src="./4aa3706a65b2fe61a60ac537bc3e9a368c1ea506.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:4.857ex; height:2.176ex;" alt="{\displaystyle {\mathsf {Hash}}}" loading="lazy">

<dl><dd>hash function (<math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle {\mathsf {hLen}}}">

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle {\mathsf {hLen}}}</annotation>

</semantics>

</math><img src="./d290e4a0484f8096d7e35c098a2ab0eee5f168d9.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:4.696ex; height:2.176ex;" alt="{\displaystyle {\mathsf {hLen}}}" loading="lazy"> denotes the length in octets of the hash function output)</dd></dl>

<div class="mw-heading mw-heading4"><h4 id="Input">Input</h4></div>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle Z}</annotation>

</semantics>

</math><img src="./1cc6b75e09a8aa3f04d8584b11db534f88fb56bd.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.68ex; height:2.176ex;" alt="{\displaystyle Z}" loading="lazy">

<dl><dd>seed from which mask is generated, an octet string</dd></dl>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle l}</annotation>

</semantics>

</math><img src="./829091f745070b9eb97a80244129025440a1cfac.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:0.693ex; height:2.176ex;" alt="{\displaystyle l}" loading="lazy">

<dl><dd>intended length in octets of the mask, at most <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle 2^{32}({\mathsf {hLen}})}">

<msup>

</mrow>

</msup>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle 2^{32}({\mathsf {hLen}})}</annotation>

</semantics>

</math><img src="./440f273b98e02cafc11fd5c69425a136f2ec92fa.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:9.544ex; height:3.176ex;" alt="{\displaystyle 2^{32}({\mathsf {hLen}})}" loading="lazy"></dd></dl>

<div class="mw-heading mw-heading4"><h4 id="Output">Output</h4></div>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle {\mathsf {mask}}}</annotation>

</semantics>

</math><img src="./9dd5562a4414f472754a8b08cb241699c3b2a148.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:4.991ex; height:2.176ex;" alt="{\displaystyle {\mathsf {mask}}}" loading="lazy">

<dl><dd>mask, an octet string of length <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle l}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle l}</annotation>

</semantics>

</math><img src="./829091f745070b9eb97a80244129025440a1cfac.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:0.693ex; height:2.176ex;" alt="{\displaystyle l}" loading="lazy">; or "mask too long"</dd></dl>

<div class="mw-heading mw-heading4"><h4 id="Steps">Steps</h4></div>

<div><ol style="list-style-type:decimal"><li>If <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle l>2^{32}({\mathsf {hLen}})}">

<msup>

</mrow>

</msup>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle l>2^{32}({\mathsf {hLen}})}</annotation>

</semantics>

</math><img src="./0eab502edf30e3db8fb6a20261e906c76a77d786.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:13.336ex; height:3.176ex;" alt="{\displaystyle l>2^{32}({\mathsf {hLen}})}" loading="lazy">, output "mask too long" and stop.</li><li>Let <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle T}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle T}</annotation>

</semantics>

</math><img src="./ec7200acd984a1d3a3d7dc455e262fbe54f7f6e0.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.636ex; height:2.176ex;" alt="{\displaystyle T}" loading="lazy"> be the empty octet string.</li><li>For <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle {\mathsf {counter}}}">

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle {\mathsf {counter}}}</annotation>

</semantics>

</math><img src="./6226b76a6b5f1a03cfd498acfe2ec67ce80aa3b0.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:7.266ex; height:1.843ex;" alt="{\displaystyle {\mathsf {counter}}}" loading="lazy"> from <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle 0}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle 0}</annotation>

</semantics>

</math><img src="./2aae8864a3c1fec9585261791a809ddec1489950.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.162ex; height:2.176ex;" alt="{\displaystyle 0}" loading="lazy"> to <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle \left\lceil {\tfrac {l}{\mathsf {hLen}}}\right\rceil -1}">

<mrow>

<mfrac>

</mrow>

</mfrac>

</mstyle>

</mrow>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle \left\lceil {\tfrac {l}{\mathsf {hLen}}}\right\rceil -1}</annotation>

</semantics>

</math><img src="./bdfa92f705acca0e057376001625af28b019580e.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -1.838ex; width:10.615ex; height:4.843ex;" alt="{\displaystyle \left\lceil {\tfrac {l}{\mathsf {hLen}}}\right\rceil -1}" loading="lazy">, do the following:

<div><ol style="list-style-type:lower-alpha"><li>Convert <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle {\mathsf {counter}}}">

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle {\mathsf {counter}}}</annotation>

</semantics>

</math><img src="./6226b76a6b5f1a03cfd498acfe2ec67ce80aa3b0.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:7.266ex; height:1.843ex;" alt="{\displaystyle {\mathsf {counter}}}" loading="lazy"> to an octet string <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle C}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle C}</annotation>

</semantics>

</math><img src="./4fc55753007cd3c18576f7933f6f089196732029.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.766ex; height:2.176ex;" alt="{\displaystyle C}" loading="lazy"> of length <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle 4}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle 4}</annotation>

</semantics>

</math><img src="./295b4bf1de7cd3500e740e0f4f0635db22d87b42.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.162ex; height:2.176ex;" alt="{\displaystyle 4}" loading="lazy"> with the primitive <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle {\mathsf {I2OSP}}}">

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle {\mathsf {I2OSP}}}</annotation>

</semantics>

</math><img src="./0278a7432ba361893775d07e561c5121dada47dc.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:6.298ex; height:2.176ex;" alt="{\displaystyle {\mathsf {I2OSP}}}" loading="lazy">:

</mrow>

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle C={\mathsf {I2OSP}}({\mathsf {counter}},4)}</annotation>

</semantics>

</math><img src="./6498cc9255e2d43d990cdd43ee5ccf8e7649efe6.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:22.434ex; height:2.843ex;" alt="{\displaystyle C={\mathsf {I2OSP}}({\mathsf {counter}},4)}" loading="lazy"></dd></dl></li><li>Concatenate the hash of the seed <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle Z}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle Z}</annotation>

</semantics>

</math><img src="./1cc6b75e09a8aa3f04d8584b11db534f88fb56bd.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.68ex; height:2.176ex;" alt="{\displaystyle Z}" loading="lazy"> and <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle C}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle C}</annotation>

</semantics>

</math><img src="./4fc55753007cd3c18576f7933f6f089196732029.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.766ex; height:2.176ex;" alt="{\displaystyle C}" loading="lazy"> to the octet string <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle T}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle T}</annotation>

</semantics>

</math><img src="./ec7200acd984a1d3a3d7dc455e262fbe54f7f6e0.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.636ex; height:2.176ex;" alt="{\displaystyle T}" loading="lazy">:

</mrow>

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle T=T\shortparallel {\mathsf {Hash}}(Z\shortparallel C)}</annotation>

</semantics>

</math><img src="./b171674de40812d0caada781e054f50be380c745.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.838ex; width:20.873ex; height:2.843ex;" alt="{\displaystyle T=T\shortparallel {\mathsf {Hash}}(Z\shortparallel C)}" loading="lazy"></dd></li></ol></div></li><li>Output the leading <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle l}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle l}</annotation>

</semantics>

</math><img src="./829091f745070b9eb97a80244129025440a1cfac.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:0.693ex; height:2.176ex;" alt="{\displaystyle l}" loading="lazy"> octets of <math xmlns="http://www.w3.org/1998/Math/MathML" alttext="{\displaystyle T}">

</mstyle>

</mrow>

<annotation encoding="application/x-tex">{\displaystyle T}</annotation>

</semantics>

</math><img src="./ec7200acd984a1d3a3d7dc455e262fbe54f7f6e0.svg" class="mwe-math-fallback-image-inline mw-invert skin-invert" aria-hidden="true" style="vertical-align: -0.338ex; width:1.636ex; height:2.176ex;" alt="{\displaystyle T}" loading="lazy"> as the octet string mask.</li></ol></div>

</blockquote>

<div class="mw-heading mw-heading3"><h3 id="Example_code">Example code</h3></div>

Below is Python code implementing MGF1:

<div class="mw-highlight mw-highlight-lang-python mw-content-ltr" dir="ltr"><pre>import hashlib

def mgf1(seed: bytes, length: int, hash_func=hashlib.sha1) -> bytes:

"""Mask generation function."""

hLen = hash_func().digest_size

# https://www.ietf.org/rfc/rfc2437.txt

# 1. If l > 2^32(hLen), output "mask too long" and stop.

if length > (hLen << 32):

raise ValueError("mask too long")

# 2. Let T be the empty octet string.

T = b""

# 3. For counter from 0 to \lceil{l / hLen}\rceil-1, do the following:

# Note: \lceil{l / hLen}\rceil-1 is the number of iterations needed,

# but it's easier to check if we have reached the desired length.

counter = 0

while len(T) < length:

# a. Convert counter to an octet string C of length 4 with the primitive I2OSP: C = I2OSP (counter, 4)

C = int.to_bytes(counter, 4, "big")

# b. Concatenate the hash of the seed Z and C to the octet string T: T = T || Hash (Z || C)

T += hash_func(seed + C).digest()

counter += 1

# 4. Output the leading l octets of T as the octet string mask.

return T[:length]

</pre></div>

Example outputs of MGF1:

<div class="mw-highlight mw-highlight-lang-pycon mw-content-ltr" dir="ltr"><pre>Python 3.10.4 (main, Apr 16 2022, 16:28:41) [GCC 8.3.0] on linux

Type "help", "copyright", "credits" or "license" for more information.

>>> from mgf1 import mgf1

>>> from hashlib import sha256

>>> mgf1(b"foo", 3).hex()

'1ac907'

>>> mgf1(b"foo", 5).hex()

'1ac9075cd4'

>>> mgf1(b"bar", 5).hex()

'bc0c655e01'

>>> mgf1(b"bar", 50).hex()

'bc0c655e016bc2931d85a2e675181adcef7f581f76df2739da74faac41627be2f7f415c89e983fd0ce80ced9878641cb4876'

>>> mgf1(b"bar", 50, sha256).hex()

'382576a7841021cc28fc4c0948753fb8312090cea942ea4c4e735d10dc724b155f9f6069f289d61daca0cb814502ef04eae1'

</pre></div>

<div class="mw-heading mw-heading2"><h2 id="References">References</h2></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output .reflist{margin-bottom:0.5em;list-style-type:decimal}@media screen{.mw-parser-output .reflist{font-size:90%}}.mw-parser-output .reflist .references{font-size:100%;margin-bottom:0;list-style-type:inherit}.mw-parser-output .reflist-columns-2{column-width:30em}.mw-parser-output .reflist-columns-3{column-width:25em}.mw-parser-output .reflist-columns{margin-top:0.3em}.mw-parser-output .reflist-columns ol{margin-top:0}.mw-parser-output .reflist-columns li{page-break-inside:avoid;break-inside:avoid-column}.mw-parser-output .reflist-upper-alpha{list-style-type:upper-alpha}.mw-parser-output .reflist-upper-roman{list-style-type:upper-roman}.mw-parser-output .reflist-lower-alpha{list-style-type:lower-alpha}.mw-parser-output .reflist-lower-greek{list-style-type:lower-greek}.mw-parser-output .reflist-lower-roman{list-style-type:lower-roman}

/* end https://en.wikipedia.org/ */

</style><div class="reflist">

/* start https://en.wikipedia.org/ */

.mw-parser-output cite.citation{font-style:inherit;word-wrap:break-word}.mw-parser-output .citation q{quotes:"\"""\"""'""'"}.mw-parser-output .citation:target{background-color:rgba(0,127,255,0.133)}.mw-parser-output .id-lock-free.id-lock-free a{background:url("./mw/Lock-green.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-limited.id-lock-limited a,.mw-parser-output .id-lock-registration.id-lock-registration a{background:url("./mw/Lock-gray-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-subscription.id-lock-subscription a{background:url("./mw/Lock-red-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .cs1-ws-icon a{background:url("./mw/Wikisource-logo.svg")right 0.1em center/12px no-repeat}body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-free a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-limited a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-registration a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-subscription a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .cs1-ws-icon a{background-size:contain;padding:0 1em 0 0}.mw-parser-output .cs1-code{color:inherit;background:inherit;border:none;padding:inherit}.mw-parser-output .cs1-hidden-error{display:none;color:var(--color-error,#d33)}.mw-parser-output .cs1-visible-error{color:var(--color-error,#d33)}.mw-parser-output .cs1-maint{display:none;color:#085;margin-left:0.3em}.mw-parser-output .cs1-kern-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right{padding-right:0.2em}.mw-parser-output .citation .mw-selflink{font-weight:inherit}@media screen{.mw-parser-output .cs1-format{font-size:95%}html.skin-theme-clientpref-night .mw-parser-output .cs1-maint{color:#18911f}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .cs1-maint{color:#18911f}}

/* end https://en.wikipedia.org/ */

</style><cite id="CITEREFRSA_Laboratories" class="citation web cs1">RSA Laboratories. <a rel="nofollow" class="external text" href="https://www.ietf.org/rfc/rfc2437.txt">"RFC 2437 PKCS #1"</a>.</cite>

</li>

<li id="cite_note-2"><a href="#cite_ref-2">^</a> <cite id="CITEREFNational_Institute_of_Standards_and_Technology2012" class="citation journal cs1">National Institute of Standards and Technology (2012). <a rel="nofollow" class="external text" href="http://csrc.nist.gov/publications/nistpubs/800-90A/SP800-90A.pdf">"Recommendation for Random Number Generation Using Deterministic Random Bit Generators"</a> (PDF). <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.6028%2FNIST.SP.800-90A">10.6028/NIST.SP.800-90A</a>.</cite> <code class="cs1-code">{{cite journal}}</code>: Cite journal requires <code class="cs1-code">|journal=</code> (help)

</li>

</ol></div></div></div><div><div class="zim-footer">

This article is issued from <a class="external text" title="Last edited on 2024-04-08" href="https://en.wikipedia.org/wiki/?title=Mask_generation_function&oldid=1217939385">Wikipedia</a>. The text is available under <a class="external text" href="https://creativecommons.org/licenses/by-sa/4.0/deed.en">Creative Commons Attribution-Share Alike 4.0</a> unless otherwise noted. Additional terms may apply for the media files.

</div>

</div></div>

</div>

</main>

</div>

</body></html>