code: func EncryptPKCS1v15(rand io.Reader, pub *PublicKey, msg []byte) (out []byte, err error) {
  	if err := checkPub(pub); err != nil {
  		return nil, err
  	}
  	k := (pub.N.BitLen() + 7) / 8
  	if len(msg) > k-11 {
  		err = ErrMessageTooLong
  		return
  	}
  
  	// EM = 0x00 || 0x02 || PS || 0x00 || M
  	em := make([]byte, k)
  	em[1] = 2
  	ps, mm := em[2:len(em)-len(msg)-1], em[len(em)-len(msg):]
  	err = nonZeroRandomBytes(ps, rand)
  	if err != nil {
  		return
  	}
  	em[len(em)-len(msg)-1] = 0
  	copy(mm, msg)
  
  	m := new(big.Int).SetBytes(em)
  	c := encrypt(new(big.Int), pub, m)
  
  	copyWithLeftPad(em, c.Bytes())
  	out = em
  	return
  }
docs: // EncryptPKCS1v15 encrypts the given message with RSA and the padding scheme from PKCS#1 v1.5.
  // The message must be no longer than the length of the public modulus minus 11 bytes.
  //
  // The rand parameter is used as a source of entropy to ensure that encrypting
  // the same message twice doesn't result in the same ciphertext.
  //
  // WARNING: use of this function to encrypt plaintexts other than session keys
  // is dangerous. Use RSA OAEP in new protocols.