Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I would like to use unpadded RSA for homomorphic encryption in a toy P2P game, for things like fair coin flips and shuffling.

How many bits of security does unpadded RSA have, in relation to its key size?

share|improve this question
3  
I don't think you are asking the right question. It isn't the "bits of security" I would be worried about, it is the lack of semantic security of unpadded RSA that would concern me. So, if you need a multiplicatively homomorphic cryptosystem, I'd say, stick with ElGamal. –  mikeazo Oct 1 '12 at 16:01

1 Answer 1

up vote 5 down vote accepted

None.

When enciphering any small set of values (including a fair coin flip, a byte, even a small password..), unpadded RSA (or RSA with any padding that does not include randomness) is a terminally weak encryption method: the adversary can enumerate the possible plaintext values, encrypt them using the public key, and check against the ciphertext to determine if the candidate plaintext value being enumerated is the right one.

share|improve this answer
    
I just realized unpadded RSA is not the same as SRA –  tm1rbrt Jul 25 '13 at 12:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.