Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

I am currently developing a messaging application that uses rsa end to end encryption. The client generates permanent rsa keys, and sends the public key to my server for account management. As it currently is, my program will take any keys, without validation. This is a big security risk, so I need to validate the keys in some way, without knowlege of the private keys. How would I go about doing this?

share|improve this question

marked as duplicate by e-sushi, rath, DrLecter, AFS, Gilles Mar 3 '14 at 17:05

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

While there are some obvious checks you can do, you can't cover everything:

  • You can check that the modulus is a composite odd number of the appropriate size

  • If you want to put in the effort, you can do a quick check if the modulus has any small factors

  • You can check if the public exponent is an odd number > 1

However, you can't check beyond that; you can't check if the modulus might not be specially built to be easy to factor, and you can't check if the public exponent is actually relatively prime to $\phi(N)$. What is likely more important to you, RSA doesn't provide a way to verify that the public key entered is the specific public key of the intended receiver.

BTW: you said that this is a big security risk; what is the scenario that you fear that an attacker might introduce a bogus key, and gain some advantage? If it's the fear that someone might substitute their public key, well, since they're likely to substitute a valid key, a validity check on the key isn't likely to protect you. Instead, you need some other mechanism to tie the public key with the identity.

share|improve this answer
The only such scenario I'm aware of is NIZK proofs. $\;$ – Ricky Demer Mar 2 '14 at 23:19
Also, Atsch could check that the modulus is not a perfect power. $\;$ – Ricky Demer Mar 3 '14 at 1:01
Blind RSA signatures might have some issues if the modulus has a small factors since padded signatures/blinding factors might share factors with the modulus. – CodesInChaos Mar 3 '14 at 9:21

Not the answer you're looking for? Browse other questions tagged or ask your own question.