docs: function oaep_unpad(d, n, hash)
  {
      d = d.toByteArray();
  
      var i;
  
      for (i = 0; i < d.length; i += 1)
      {
          d[i] &= 0xff;
      }
  
      while (d.length < n)
      {
          d.unshift(0);
      }
  
      d = String.fromCharCode.apply(String, d);
  
      if (d.length < 2 * SHA1_SIZE + 2)
      {
          throw "Cipher too short";
      }
  
      var maskedSeed = d.substr(1, SHA1_SIZE)
      var maskedDB = d.substr(SHA1_SIZE + 1);
  
      var seedMask = oaep_mgf1_str(maskedDB, SHA1_SIZE, hash || rstr_sha1);
      var seed = [], i;
  
      for (i = 0; i < maskedSeed.length; i += 1)
      {
          seed[i] = maskedSeed.charCodeAt(i) ^ seedMask.charCodeAt(i);
      }
  
      var dbMask = oaep_mgf1_str(String.fromCharCode.apply(String, seed),
                             d.length - SHA1_SIZE, rstr_sha1);
  
      var DB = [];
  
      for (i = 0; i < maskedDB.length; i += 1)
      {
          DB[i] = maskedDB.charCodeAt(i) ^ dbMask.charCodeAt(i);
      }
  
      DB = String.fromCharCode.apply(String, DB);
  
      if (DB.substr(0, SHA1_SIZE) !== rstr_sha1(''))
      {
          throw "Hash mismatch";
      }
  
      DB = DB.substr(SHA1_SIZE);
  
      var first_one = DB.indexOf('\x01');
      var last_zero = (first_one != -1) ? DB.substr(0, first_one).lastIndexOf('\x00') : -1;
  
      if (last_zero + 1 != first_one)
      {
          throw "Malformed data";
      }
  
      return DB.substr(first_one + 1);
  }