in src/rsa.js [338:398]
OAEP_ENCODE: function(sha, m, rng, p) {
var olen = RSA.RFS - 1,
mlen = m.length,
SEED = [],
DBMASK = [],
f = [],
hlen,
seedlen,
slen,
i, d, h;
seedlen = hlen = sha;
if (mlen > olen - hlen - seedlen - 1) {
return null;
}
h = this.hashit(sha, p, -1);
for (i = 0; i < hlen; i++) {
f[i] = h[i];
}
slen = olen - mlen - hlen - seedlen - 1;
for (i = 0; i < slen; i++) {
f[hlen + i] = 0;
}
f[hlen + slen] = 1;
for (i = 0; i < mlen; i++) {
f[hlen + slen + 1 + i] = m[i];
}
for (i = 0; i < seedlen; i++) {
SEED[i] = rng.getByte();
}
this.MGF1(sha, SEED, olen - seedlen, DBMASK);
for (i = 0; i < olen - seedlen; i++) {
DBMASK[i] ^= f[i];
}
this.MGF1(sha, DBMASK, seedlen, f);
for (i = 0; i < seedlen; i++) {
f[i] ^= SEED[i];
}
for (i = 0; i < olen - seedlen; i++) {
f[i + seedlen] = DBMASK[i];
}
/* pad to length RFS */
d = 1;
for (i = RSA.RFS - 1; i >= d; i--) {
f[i] = f[i - d];
}
for (i = d - 1; i >= 0; i--) {
f[i] = 0;
}
return f;
},