docs: function oaep_pad(s, n, hash)
  {
      if (s.length + 2 * SHA1_SIZE + 2 > n)
      {
          throw "Message too long for RSA";
      }
  
      var PS = '', i;
  
      for (i = 0; i < n - s.length - 2 * SHA1_SIZE - 2; i += 1)
      {
          PS += '\x00';
      }
  
      var DB = rstr_sha1('') + PS + '\x01' + s;
      var seed = new Array(SHA1_SIZE);
      new SecureRandom().nextBytes(seed);
      
      var dbMask = oaep_mgf1_arr(seed, DB.length, hash || rstr_sha1);
      var maskedDB = [];
  
      for (i = 0; i < DB.length; i += 1)
      {
          maskedDB[i] = DB.charCodeAt(i) ^ dbMask.charCodeAt(i);
      }
  
      var seedMask = oaep_mgf1_arr(maskedDB, seed.length, rstr_sha1);
      var maskedSeed = [0];
  
      for (i = 0; i < seed.length; i += 1)
      {
          maskedSeed[i + 1] = seed[i] ^ seedMask.charCodeAt(i);
      }
  
      return new BigInteger(maskedSeed.concat(maskedDB));
  }