def OAEP_enc(m, g, h, k0, k1):
assert len(m) * 8 == g.out_size - k1, "Wrong message length"
m = Bits(m.ljust(g.out_size//8, b'\0'))
r = get_random_bytes(k0//8)
x = m ^ g(r).bits
y = h(x.bytes).bits ^ Bits(r)
return (x+y).tobytes()
