private byte[] unpadOAEP(byte[] padded) throws BadPaddingException {
byte[] EM = padded;
int hLen = lHash.length;
if (EM[0] != 0) {
throw new BadPaddingException("Data must start with zero");
}
int seedStart = 1;
int seedLen = hLen;
int dbStart = hLen + 1;
int dbLen = EM.length - dbStart;
mgf1(EM, dbStart, dbLen, EM, seedStart, seedLen);
mgf1(EM, seedStart, seedLen, EM, dbStart, dbLen);
// verify lHash == lHash'
for (int i = 0; i < hLen; i++) {
if (lHash[i] != EM[dbStart + i]) {
throw new BadPaddingException("lHash mismatch");
}
}
// skip over padding (0x00 bytes)
int i = dbStart + hLen;
while (EM[i] == 0) {
i++;
if (i >= EM.length) {
throw new BadPaddingException("Padding string not terminated");
}
}
if (EM[i++] != 1) {
throw new BadPaddingException
("Padding string not terminated by 0x01 byte");
}
int mLen = EM.length - i;
byte[] m = new byte[mLen];