Aha, I have discovered my mistake: I did not see step 11 of the procedure:
11. Set the leftmost 8emLen – emBits bits of the leftmost octet in maskedDB to zero. (page 36)
As a result of this step, OS2IP(EM) < 2^emBits < n < 2^modBits and so the signature works. Sorry for the false alarm!
-- __ \/ o\ Paul Crowley, [email protected] /\__/ http://www.ciphergoth.org/ _______________________________________________ cryptography mailing list [email protected] http://lists.randombit.net/mailman/listinfo/cryptography
