(M, EM, emBits, h, mgf, sLen)
return H == HPrime
Implements EMSA-PSS-VERIFY() function described in Sect. 9.1.2 of RFC 3447

    Input:
       M     : message to be encoded, an octet string
       EM    : encoded message, an octet string of length emLen = ceil(emBits/8)
       emBits: maximal bit length of the integer resulting of pkcs_os2ip(EM)
       h     : hash function name (in 'md2', 'md4', 'md5', 'sha1', 'tls',
               'sha256', 'sha384'). hLen denotes the length in octets of
               the hash function output.
       mgf   : the mask generation function f : seed, maskLen -> mask
       sLen  : intended length in octets of the salt

    Output:
       True if the verification is ok, False otherwise.
Implements EMSA-PSS-VERIFY() function described in Sect. 9.1.2 of RFC 3447
Implements EMSA - PSS - VERIFY () function described in Sect . 9 . 1 . 2 of RFC 3447
def pkcs_emsa_pss_verify(M, EM, emBits, h, mgf, sLen):
    """
    Implements EMSA-PSS-VERIFY() function described in Sect. 9.1.2 of RFC 3447

    Input:
       M     : message to be encoded, an octet string
       EM    : encoded message, an octet string of length emLen = ceil(emBits/8)
       emBits: maximal bit length of the integer resulting of pkcs_os2ip(EM)
       h     : hash function name (in 'md2', 'md4', 'md5', 'sha1', 'tls',
               'sha256', 'sha384'). hLen denotes the length in octets of
               the hash function output.
       mgf   : the mask generation function f : seed, maskLen -> mask
       sLen  : intended length in octets of the salt

    Output:
       True if the verification is ok, False otherwise.
    """
    
    # 1) is not done
    hLen = _hashFuncParams[h][0]                             # 2)
    hFunc = _hashFuncParams[h][1]
    mHash = hFunc(M)
    emLen = int(math.ceil(emBits/8.))                        # 3)
    if emLen < hLen + sLen + 2:
        return False
    if EM[-1] != '\xbc':                                     # 4)
        return False
    l = emLen - hLen - 1                                     # 5)
    maskedDB = EM[:l]
    H = EM[l:l+hLen]
    l = (8*emLen - emBits)/8                                 # 6)
    rem = 8*emLen - emBits - 8*l # additionnal bits
    andMask = l*'\xff'
    if rem:
        val = reduce(lambda x,y: x+y, map(lambda x: 1<<x, range(8-rem)))
        j = chr(~val & 0xff)
        andMask += j
        l += 1
    if strand(maskedDB[:l], andMask) != '\x00'*l:
        return False
    dbMask = mgf(H, emLen - hLen - 1)                        # 7)
    DB = strxor(maskedDB, dbMask)                            # 8)
    l = (8*emLen - emBits)/8                                 # 9)
    rem = 8*emLen - emBits - 8*l # additionnal bits
    andMask = l*'\x00'
    if rem:
        j = chr(reduce(lambda x,y: x+y, map(lambda x: 1<<x, range(8-rem))))
        andMask += j
        l += 1
    DB = strand(DB[:l], andMask) + DB[l:]
    l = emLen - hLen - sLen - 1                              # 10)
    if DB[:l] != '\x00'*(l-1) + '\x01':
        return False
    salt = DB[-sLen:]                                        # 11)
    MPrime = '\x00'*8 + mHash + salt                         # 12)
    HPrime = hFunc(MPrime)                                   # 13)
    return H == HPrime
def pkcs_emsa_pss_verify ( M , EM , emBits , h , mgf , sLen ) : # 1) is not done hLen = _hashFuncParams [ h ] [ 0 ] # 2) hFunc = _hashFuncParams [ h ] [ 1 ] mHash = hFunc ( M ) emLen = int ( math . ceil ( emBits / 8. ) ) # 3) if emLen < hLen + sLen + 2 : return False if EM [ - 1 ] != '\xbc' : # 4) return False l = emLen - hLen - 1 # 5) maskedDB = EM [ : l ] H = EM [ l : l + hLen ] l = ( 8 * emLen - emBits ) / 8 # 6) rem = 8 * emLen - emBits - 8 * l # additionnal bits andMask = l * '\xff' if rem : val = reduce ( lambda x , y : x + y , map ( lambda x : 1 << x , range ( 8 - rem ) ) ) j = chr ( ~ val & 0xff ) andMask += j l += 1 if strand ( maskedDB [ : l ] , andMask ) != '\x00' * l : return False dbMask = mgf ( H , emLen - hLen - 1 ) # 7) DB = strxor ( maskedDB , dbMask ) # 8) l = ( 8 * emLen - emBits ) / 8 # 9) rem = 8 * emLen - emBits - 8 * l # additionnal bits andMask = l * '\x00' if rem : j = chr ( reduce ( lambda x , y : x + y , map ( lambda x : 1 << x , range ( 8 - rem ) ) ) ) andMask += j l += 1 DB = strand ( DB [ : l ] , andMask ) + DB [ l : ] l = emLen - hLen - sLen - 1 # 10) if DB [ : l ] != '\x00' * ( l - 1 ) + '\x01' : return False salt = DB [ - sLen : ] # 11) MPrime = '\x00' * 8 + mHash + salt # 12) HPrime = hFunc ( MPrime ) # 13) return H == HPrime