function oaep_unpad(d, n, hash, hashLen) {
    var MD = KJUR.crypto.MessageDigest;
    var Util = KJUR.crypto.Util;
    var algName = null;

    if (!hash) hash = "sha1";

    if (typeof hash === "string") {
        algName = MD.getCanonicalAlgName(hash);
        hashLen = MD.getHashLength(algName);
        hash = function(s) {
            return hextorstr(Util.hashHex(rstrtohex(s), algName));
        };
    }

    d = d.toByteArray();

    var i;

    for (i = 0; i < d.length; i += 1) {
        d[i] &= 0xff;
    }

    while (d.length < n) {
        d.unshift(0);
    }

    d = String.fromCharCode.apply(String, d);

    if (d.length < 2 * hashLen + 2) {
        throw "Cipher too short";
    }

    var maskedSeed = d.substr(1, hashLen)
    var maskedDB = d.substr(hashLen + 1);

    var seedMask = oaep_mgf1_str(maskedDB, hashLen, hash);
    var seed = [], i;

    for (i = 0; i < maskedSeed.length; i += 1) {
        seed[i] = maskedSeed.charCodeAt(i) ^ seedMask.charCodeAt(i);
    }

    var dbMask = oaep_mgf1_str(String.fromCharCode.apply(String, seed),
                               d.length - hashLen, hash);

    var DB = [];

    for (i = 0; i < maskedDB.length; i += 1) {
        DB[i] = maskedDB.charCodeAt(i) ^ dbMask.charCodeAt(i);
    }

    DB = String.fromCharCode.apply(String, DB);

    if (DB.substr(0, hashLen) !== hash('')) {
        throw "Hash mismatch";
    }

    DB = DB.substr(hashLen);

    var first_one = DB.indexOf('\x01');
    var last_zero = (first_one != -1) ? DB.substr(0, first_one).lastIndexOf('\x00') : -1;

    if (last_zero + 1 != first_one) {
        throw "Malformed data";
    }

    return DB.substr(first_one + 1);
}
Undo PKCS#1 (OAEP) padding and, if valid, return the plaintext
@name oaep_unpad
@param {BigInteger} d BigInteger object of OAEP padded message
@param n byte length of RSA key (i.e. 128 when RSA 1024bit)
@param hash JavaScript function to calculate raw hash value from raw string or algorithm name (ex. "SHA1") 
@param hashLen byte length of resulted hash value (i.e. 20 for SHA1)
@return {String} raw string of OAEP unpadded message
@description
This function do unpadding OAEP padded message then returns an original message.<br/>
NOTE: Since jsrsasign 6.2.0, 'hash' argument can accept an algorithm name such as "sha1".
@example
// DEFAULT(SHA1)
bi1 = oaep_pad("aaa", 128);
oaep_unpad(bi1, 128) &rarr; "aaa" // SHA-1 by default