def decrypt(private_key, message, label=b'', hash_class=hashlib.sha1,
            mgf=mgf.mgf1):
    '''Decrypt a byte message using a RSA private key and the OAEP wrapping
       algorithm

       Parameters:
       public_key - an RSA public key
       message - a byte string
       label - a label a per-se PKCS#1 standard
       hash_class - a Python class for a message digest algorithme respecting
         the hashlib interface
       mgf1 - a mask generation function

       Return value:
       the string before encryption (decrypted)
    '''
    hash = hash_class()
    h_len = hash.digest_size
    k = private_key.byte_size
    # 1. check length
    if len(message) != k or k < 2 * h_len + 2:
        raise ValueError('decryption error')
    # 2. RSA decryption
    c = primitives.os2ip(message)
    m = private_key.rsadp(c)
    em = primitives.i2osp(m, k)
    # 4. EME-OAEP decoding
    hash.update(label)
    label_hash = hash.digest()
    y, masked_seed, masked_db = em[0], em[1:h_len+1], em[1+h_len:]
    if y != b'\x00' and y != 0:
        raise ValueError('decryption error')
    seed_mask = mgf(masked_db, h_len)
    seed = primitives.string_xor(masked_seed, seed_mask)
    db_mask = mgf(seed, k - h_len - 1)
    db = primitives.string_xor(masked_db, db_mask)
    label_hash_prime, rest = db[:h_len], db[h_len:]
    i = rest.find(b'\x01')
    if i == -1:
        raise exceptions.DecryptionError
    if rest[:i].strip(b'\x00') != b'':
        print(rest[:i].strip(b'\x00'))
        raise exceptions.DecryptionError
    m = rest[i+1:]
    if label_hash_prime != label_hash:
        raise exceptions.DecryptionError
    return m
Decrypt a byte message using a RSA private key and the OAEP wrapping
       algorithm

       Parameters:
       public_key - an RSA public key
       message - a byte string
       label - a label a per-se PKCS#1 standard
       hash_class - a Python class for a message digest algorithme respecting
         the hashlib interface
       mgf1 - a mask generation function

       Return value:
       the string before encryption (decrypted)