RSA-OAEP vs. RSA-OAEP-MGF1P

[Cantor, Scott]

> It's not so clear to me what the former indicates, though. Just using that
> algorithm alone for key transport isn't valid, as you need to indicate which
> mask generation function and digest algorithm you want to use. Indeed, the
> v3 IdP does just that and selects MGF1 with SHA-1 so everything is nicely
> compatible.

The meaning is valid, it just means that the defaults are in effect. This applies to both methods. The original algorithm doesn't actually require SHA-1, except in the mask function, so the issue here applies generally to both of them. The SP isn't advertising 4-5 of each by enumerating all the digests.

Partly that's because the SP doesn't even look at that information itself, that was too much work for supporting something that I don't think anyone but me even supported at the time. The SP always uses SHA-1 and the MGF1-SHA1 options when it encrypts, I believe.
 
> Shouldn't the SP be explicitly indicating which MGFs and digest algorithms it
> supports for use with RSA-OAEP though?

Technically, but you can see how bloated that's going to get pretty quickly. Brent would have to comment as to whether the IdP would handle it.

-- Scott