Hi, David, is the problem description right? Seems that section 9.1.1 has the EME-OAEP-encode/decode pair, while 7.1.1 is another function that uses EME-OAEP, but it is not it. Moreover, how do we apply the Feistel network inside the MGF1 (disjoint sets or with intersection: 1,1,2,2,3,3,..., n n or 2 3 4 .. .n 1)? And how many rounds? 2 or more? Should the Feistel network replace the MGF1 function? Could you, please, explain?

Yes, changed description to the proper section 9.1.1.1. The steps show how the MGF1 function is used. Look at figure 1. There are not multiple rounds.

Thanks, David. I've struggled for a while with this problem but I've finally figured it out. First, although we don't use the encryption function from 7.1.1, we must create an output EM of length k-1 and apply a pad of 0 as the first character of EM (It was strange to see all hashes starting with 0). Next, I was confused with the Feistel Network, because my MGF from the previous problem wasn't working (an accepted solution), but I realized that you were probably using a hex input, instead of char (which is weird since the MGF function requires an Octect String as input), but anyway that solved it. :)