RSA-OAEP Is Secure under the RSA Assumption