checkApprovedHash(hash) k := priv.pub.Size() if len(ciphertext) > k || k < hash.Size()*2+2 { return nil, ErrDecryption } em, err := decrypt(priv, ciphertext, noCheck) if err != nil { return nil, err } hash.Reset() hash.Write(label) lHash := hash.Sum(nil) firstByteIsZero := subtle.ConstantTimeByteEq(em[0], 0) seed := em[1 : hash.Size()+1] db := em[hash.Size()+1:] mgf1XOR(seed, mgfHash, db) mgf1XOR(db, mgfHash, seed) lHash2 := db[0:hash.Size()] // We have to validate the plaintext in constant time in order to avoid...