Carl noted that "you can't do padding until you know how bit the modulus is". I think that we should not require one algorithm to know the parameters of the preceding or following algorithm, so let's just add the length of the output as an additional parameter if that is needed in the padding. E.g. (public-key md5 (pkcs1 1024) (rsa (&n <1024-bit modulus) (e &03))) Ron Rivest