code: func VerifyPKCS1v15(pub *PublicKey, hash crypto.Hash, hashed []byte, sig []byte) (err error) {
  	hashLen, prefix, err := pkcs1v15HashInfo(hash, len(hashed))
  	if err != nil {
  		return
  	}
  
  	tLen := len(prefix) + hashLen
  	k := (pub.N.BitLen() + 7) / 8
  	if k < tLen+11 {
  		err = ErrVerification
  		return
  	}
  
  	c := new(big.Int).SetBytes(sig)
  	m := encrypt(new(big.Int), pub, c)
  	em := leftPad(m.Bytes(), k)
  	// EM = 0x00 || 0x01 || PS || 0x00 || T
  
  	ok := subtle.ConstantTimeByteEq(em[0], 0)
  	ok &= subtle.ConstantTimeByteEq(em[1], 1)
  	ok &= subtle.ConstantTimeCompare(em[k-hashLen:k], hashed)
  	ok &= subtle.ConstantTimeCompare(em[k-tLen:k-hashLen], prefix)
  	ok &= subtle.ConstantTimeByteEq(em[k-tLen-1], 0)
  
  	for i := 2; i < k-tLen-1; i++ {
  		ok &= subtle.ConstantTimeByteEq(em[i], 0xff)
  	}
  
  	if ok != 1 {
  		return ErrVerification
  	}
  
  	return nil
  }
docs: // VerifyPKCS1v15 verifies an RSA PKCS#1 v1.5 signature.
  // hashed is the result of hashing the input message using the given hash
  // function and sig is the signature. A valid signature is indicated by
  // returning a nil error. If hash is zero then hashed is used directly. This
  // isn't advisable except for interoperability.