Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to use unpadded RSA for homomorphic encryption in a toy P2P game, for things like fair coin flips and shuffling.

How many bits of security does unpadded RSA have, in relation to its key size?

share|improve this question
I don't think you are asking the right question. It isn't the "bits of security" I would be worried about, it is the lack of semantic security of unpadded RSA that would concern me. So, if you need a multiplicatively homomorphic cryptosystem, I'd say, stick with ElGamal. – mikeazo Oct 1 '12 at 16:01
up vote 6 down vote accepted


When enciphering any small set of values (including a fair coin flip, a byte, even a small password..), unpadded RSA (or RSA with any padding that does not include randomness) is a terminally weak encryption method: the adversary can enumerate the possible plaintext values, encrypt them using the public key, and check against the ciphertext to determine if the candidate plaintext value being enumerated is the right one.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.