OAEP requires SHA1 inside the MGF1. It can't be that broken?