Mask generation function

Mask generation functions were first proposed as part of the specification for padding in the RSA-OAEP algorithm. The OAEP algorithm required a cryptographic hash function that could generate an output equal in size to a "data block" whose length was proportional to arbitrarily sized input message.[1]

NIST Special Publication 800-90A[2] defines a class of cryptographically secure random number generators, one of which is the "Hash DRBG", which uses a hash function with a counter to produce a requested sequence of random bits equal in size to the requested number of random bits.

MGF1 is a mask generation function defined in the Public Key Cryptography Standard #1 published by RSA Laboratories:[1]

Options

${\displaystyle {\mathsf {Hash}}}$

hash function (${\displaystyle {\mathsf {hLen}}}$ denotes the length in octets of the hash function output)

Input

${\displaystyle Z}$

seed from which mask is generated, an octet string

${\displaystyle l}$

intended length in octets of the mask, at most ${\displaystyle 2^{32}({\mathsf {hLen}})}$

Output

${\displaystyle {\mathsf {mask}}}$

mask, an octet string of length ${\displaystyle l}$; or "mask too long"

Steps

1. If ${\displaystyle l>2^{32}({\mathsf {hLen}})}$, output "mask too long" and stop.
2. Let ${\displaystyle T}$ be the empty octet string.
3. For ${\displaystyle {\mathsf {counter}}}$ from ${\displaystyle 0}$ to ${\displaystyle \left\lceil {\tfrac {l}{\mathsf {hLen}}}\right\rceil -1}$, do the following:
   1. Convert ${\displaystyle {\mathsf {counter}}}$ to an octet string ${\displaystyle C}$ of length ${\displaystyle 4}$ with the primitive ${\displaystyle {\mathsf {I2OSP}}}$:

      ${\displaystyle C={\mathsf {I2OSP}}({\mathsf {counter}},4)}$

   2. Concatenate the hash of the seed ${\displaystyle Z}$ and ${\displaystyle C}$ to the octet string ${\displaystyle T}$:

      ${\displaystyle T=T\shortparallel {\mathsf {Hash}}(Z\shortparallel C)}$

4. Output the leading ${\displaystyle l}$ octets of ${\displaystyle T}$ as the octet string mask.

Below is Python code implementing MGF1:

import hashlib

def mgf1(seed: bytes, length: int, hash_func=hashlib.sha1) -> bytes:
    """Mask generation function."""
    hLen = hash_func().digest_size
    # https://www.ietf.org/rfc/rfc2437.txt
    # 1. If l > 2^32(hLen), output "mask too long" and stop.
    if length > (hLen << 32):
        raise ValueError("mask too long")
    # 2. Let T be the empty octet string.
    T = b""
    # 3. For counter from 0 to \lceil{l / hLen}\rceil-1, do the following:
    # Note: \lceil{l / hLen}\rceil-1 is the number of iterations needed,
    #       but it's easier to check if we have reached the desired length.
    counter = 0
    while len(T) < length:
        # a. Convert counter to an octet string C of length 4 with the primitive I2OSP: C = I2OSP (counter, 4)
        C = int.to_bytes(counter, 4, "big")
        # b. Concatenate the hash of the seed Z and C to the octet string T: T = T || Hash (Z || C)
        T += hash_func(seed + C).digest()
        counter += 1
    # 4. Output the leading l octets of T as the octet string mask.
    return T[:length]

Example outputs of MGF1:

Python 3.10.4 (main, Apr 16 2022, 16:28:41) [GCC 8.3.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> from mgf1 import mgf1
>>> from hashlib import sha256
>>> mgf1(b"foo", 3).hex()
'1ac907'
>>> mgf1(b"foo", 5).hex()
'1ac9075cd4'
>>> mgf1(b"bar", 5).hex()
'bc0c655e01'
>>> mgf1(b"bar", 50).hex()
'bc0c655e016bc2931d85a2e675181adcef7f581f76df2739da74faac41627be2f7f415c89e983fd0ce80ced9878641cb4876'
>>> mgf1(b"bar", 50, sha256).hex()
'382576a7841021cc28fc4c0948753fb8312090cea942ea4c4e735d10dc724b155f9f6069f289d61daca0cb814502ef04eae1'