Public Key Cryptography frequently uses mask generation functions (MGFs) to achieve a particular security goal. For example, MGFs are used both in RSA-OAEP encryption and RSA-SSA signature schemes.
MGF function takes an octet string of a variable length and generates an octet string of a desired length. MGFs are deterministic, which means that the input octet string completely determines the output one. The output of an MGF should be pseudorandom, that is, infeasible to predict. The provable security of such cryptography schemes as RSA-OAEP or RSA-SSA, relies on the random nature of the MGF output. That is why one-way hash functions is one of the well-known ways to implement an MGF. The exact definition of an MGF based on a one-way hash function may be found in [PKCS 1.2.1].
This section describes MGFs based on widely-used MD5, SHA-1, SHA-224, SHA-256, SHA-384 and SHA-512 hash algorithms as well as the possibility to use a different implementation of MGF.
Note
Intel IPP implementation of MGFs limits length (in octets) of an input message for any specific MGF by the range of the int data type, with the upper bound of 232-1.