Figure 5: PSS padding format. Message representative consists of a masked data block followed by a second-level hash value HH and additional padding. The masked data block is computed by XORing a data block consisting of padding and a salt value with a mask derived from the second-level hash value; the second-level hash value is the result of applying a hash function to a string consisting of padding, the original hash value, and a randomly generated salt value. 00, 01 and bc are byte values in hexadecimal. The message representative is the same length in bytes as the signer's RSA modulus. During signature verification, the salt value is recovered from the message representative by XORing with the mask, then the second-level hash value is recomputed and checked. (Some details are omitted, such as the truncation of leading bits in the masked data block to ensure that the message representative is shorter than the modulus.)
