the leftmost octet in // maskedDB are not all equal to zero, output "inconsistent" and // stop. var bitMask byte = 0xff >> (8*emLen - emBits) if em[0] & ^bitMask != 0 { return ErrVerification } // 7. Let dbMask = MGF(H, emLen - hLen - 1). // // 8. Let DB = maskedDB \xor dbMask. mgf1XOR(db, hash, h) // 9. Set the leftmost 8 * emLen - emBits bits of the leftmost octet in DB // to zero. db[0] &= bitMask // If we don't know the salt length, look for the 0x01 delimiter. if sLen == pssSaltLengthAutodet {...