// the [crypto.Decrypter] interface.
type PKCS1v15DecryptOptions struct {
	// SessionKeyLen is the length of the session key that is being
	// decrypted. If not zero, then a padding error during decryption will
	// cause a random plaintext of this length to be returned rather than
	// an error. These alternatives happen in constant time.
	SessionKeyLen int
}

// EncryptPKCS1v15 encrypts the given message with RSA and the padding

	}
	// Perform constant time RSA PKCS #1 v1.5 decryption
	preMasterSecret, err := priv.Decrypt(config.rand(), ciphertext, &rsa.PKCS1v15DecryptOptions{SessionKeyLen: 48})
	if err != nil {
		return nil, err
	}
	// We don't check the version number in the premaster secret. For one,
	// by checking it, we would leak information about the validity of the

		} else {
			return decryptOAEP(opts.Hash.New(), opts.MGFHash.New(), rand, priv, ciphertext, opts.Label)
		}

	case *PKCS1v15DecryptOptions:
		if l := opts.SessionKeyLen; l > 0 {
			plaintext = make([]byte, l)
			if _, err := io.ReadFull(rand, plaintext); err != nil {
				return nil, err
			}
			if err := DecryptPKCS1v15SessionKey(rand, priv, ciphertext, plaintext); err != nil {

pkg crypto/rsa, type OAEPOptions struct, Hash crypto.Hash
pkg crypto/rsa, type OAEPOptions struct, Label []uint8
pkg crypto/rsa, type PKCS1v15DecryptOptions struct
pkg crypto/rsa, type PKCS1v15DecryptOptions struct, SessionKeyLen int
pkg crypto/sha512, const Size224 = 28
pkg crypto/sha512, const Size224 ideal-int
pkg crypto/sha512, const Size256 = 32
pkg crypto/sha512, const Size256 ideal-int
pkg crypto/sha512, func New512_224() hash.Hash