Modular arithmetic is a system of arithmetic for integers, where numbers "wrap around" upon reaching a certain value… the modulus.

learn more… | top users | synonyms

12
votes
1answer
10k views

Calculating RSA private exponent when given public exponent and the modulus factors using extended euclid

When given $p = 5, q = 11, N = 55$ and $e = 17$, I'm trying to compute the RSA private key $d$. I can calculate $\varphi(N) = 40$, but my lecturer then says to use the extended Euclidean algorithm to ...
10
votes
1answer
217 views

Shadowed identity in cryptography

I was trying to implement zero knowledge protocol for authentication based on the paper "A Practical Zero-Knowledge Protocol Fitted to Security Microprocessor Minimizing Both Transmission and Memory". ...
7
votes
2answers
621 views

How does Clifford Cocks 'Non-Secret Encryption' work?

I have read Clifford Cocks "A Note on 'Non-secret Encryption'" and thought I would try to implement this, but I don't seem to be able to get it to work. I'm obviously missing something. From the ...
6
votes
3answers
2k views

Is sharing the modulus for multiple RSA key pairs secure?

In the public-key system RSA scheme, each user holds beyond a public modulus $m$ a public exponent, $e$, and a private exponent, $d$. Suppose that Bob's private exponent is learned by other users. ...
6
votes
1answer
276 views

How does NaCL Poly1305 implementation do modular multiplication?

The NaCL ref implementation of Poly1305 performs modular multiplication to calculate a polynomial $\mod 2^{130} - 5$ using the following modular multiplication ...
6
votes
1answer
239 views

Why does this square root algorithm work?

I've been doing some elliptic curve cryptography, and a library I'm using has this slightly bizarre algorithm for computing modular square roots: Let $x$ be some quadratic residue modulo $p$ for some ...
5
votes
3answers
662 views

RSA with modulus n=p²q

I've been wondering what would happen if the RSA modulus would be $n=p^2q$ instead of $n=pq$. I feel like there is an obvious security flaw (as there is with most modifications). Would this choise of ...
5
votes
2answers
2k views

In RSA, why is it important choosing e so that it is coprime to φ(n)?

When choosing the public exponent e, it is stressed that $e$ must be coprime to $\phi(n)$, i.e. $\gcd(\phi(n), e) = 1$. I know that a common choice is to have $e = 3$ (which requires a good padding ...
4
votes
4answers
429 views

Where does the $\varphi(n)$ part of RSA come from?

$e d \equiv 1 \pmod{\varphi(n)}$ Where does the $\varphi(n)$ part come from? How did the inventors of RSA arrive at $\varphi(n)$?
4
votes
2answers
401 views

Exactly two of the four roots must be greater than N/2

Theorem: Let $y$ be a quadratic residue in $\mathbb{Z}_N$* where $N=pq$. There are exactly four integers $x_1, x_2, x_3, x_4$ where $0 < x_1 < x_2 < \frac{N}{2} < x_3 < x_4 < N$ ...
4
votes
1answer
1k views

Which one is fastest? Karatsuba or Montgomery multiplication?

Is there any complexity analysis between Karatsuba and Montgomery multiplication algorithms? It seems that Karatsuba is more general in the sense that is not modulo tuned while Montgomery it is. Does ...
4
votes
2answers
233 views

how to iteratively calculate a^emod n with modulus n sized 4096 bits

In most sites the exponent of the RSA public key is 24 bits. But the modulus can get to 4096 bits size. I have an accelerator that can get max. 2112 bit size modulus. It calculates ...
4
votes
1answer
208 views

Solve a Modular Exponentiation

It might be common, but if we had to solve an equation like this $m=s^{e}$ mod $n$ where $m,e,n$ are known. How can we find $s$. What optimisations could be applied? And what would the complexity of ...
4
votes
1answer
89 views

What are the computational benefits of primes close to the power of 2?

Recently I was reading some article about the Bernstein's Curve25519. This is a particular Montgomery curve over $\mathbb{F}_q$ where $q = {2^{255}-19}$. What I missed or was unable to understand is ...
4
votes
4answers
681 views

How do institutions like banks do RSA with big primes?

When encrypting with RSA it is often infeasible to decrypt by just doing c^d mod n, because for example when using the primes $(p,q)=(12553,1233)$, which are small ...
4
votes
1answer
584 views

Understanding elliptic curve encryption

I'm having a hard time understanding the elliptic curve encryption. One thing thing I don't understand is listing all the points on the curve mod p. Suppose I have the following elliptic curve: $y^2 = ...
3
votes
1answer
238 views

How is information disclosed by modular multiplication?

Consider the case that $c = a \cdot b \mod p$ where $p$ is a known prime and $0 < a < p$ and $0 < b < p$ are unknown integers numbers. Furthermore, some bits on the value of $c$ are ...
3
votes
2answers
289 views

Avoiding overflow when encrypting with RSA

When encrypting with RSA one calculates $ m^e \pmod n $ by doing the following: m^e % n Where $m$ is what we encrypt. Often $e$ is a very big number to make it ...
3
votes
3answers
159 views

Attack against modular inversion operation using side-channels?

I'm building a device that performs a modular inversions using a secret modulus. I would like to know if it is possible to recover all or part of this modulus by side-channels (timing, power, EMR, ...
3
votes
2answers
762 views

Reversing DJB2 Hashes

I have some spare time, and a few hundred DJB2-hashed values sitting around. I thought I'd try to do something "useful" and invert DJB2, such that I could calculate the plaintext of the hashes (which ...
3
votes
1answer
183 views

ECDSA: How to retrieve a non-random k

I have a question regarding the random $k$ number of ECDSA encryption. As far as I know, it is possible to retrieve $k$ (and thus the private key) from two signed messages if both used the same $k$. ...
3
votes
1answer
482 views

How difficult is it to brute force d in RSA: d = (1/e) mod φ in a CPT attack?

Given that RSA key generation works by computing: n = pq φ = (p-1)(q-1) d = (1/e) mod φ If I was an attacker who wanted to brute force d, could I brute force d given just the public key, the ...
3
votes
2answers
92 views

Security concern about reducing hash value using modulo operation

As stated in the title, what I am looking for is information about a "technique" that I would like to use in some of my algorithms. Sometimes I need to map a hash function's result into a range of ...
3
votes
1answer
248 views

Decode message $m = p * q$, where $p ^ 5 \bmod N$, $q ^ 5 \bmod N$ and $N$ are known

I been going through some cryptography exercises and stumbled across this problem. Discover message $m$. You know that $m = p * q$. Also $p ^ 5 \bmod N$, $q ^ 5 \bmod N$ and $N$ are known ...
2
votes
3answers
323 views

In RSA, why does $p$ have to be bigger than $q$ where $n=p \times q$?

In openSSL – during RSA key generation – if $q$ is bigger than $p$, they exchange them. Why is that?
2
votes
2answers
318 views

How does this happen in RSA malleability?

I don't understand how the $E(m)$ turns into $E(mt)$. I mean, I don't know how does that transformation happen and how does the equation occur. $$E(m) \cdot t^e \bmod n = (mt)^e \bmod n = E(mt)$$ ...
2
votes
2answers
2k views

How to find generator $g$ in a cyclic group?

As generator $g$ is use in DH how to find combination of prime $p$ and $g$? eg: if we choose $p=23$ its generator is $7$ (given in book) how to find it?
2
votes
2answers
136 views

Speed up modular exponentation with fixed base and modulus

Can someone explain, how $a^x \mod N$ can be speeded up, when $a$ and $N$ are known constants? How big is the gain and what resources are needed? ...
2
votes
1answer
70 views

For which RSA moduli, precisely, is $e=d$ for all $e$?

This question shows that there are at least two valid RSA moduli $n$, namely $35$ and $91$, such that for any $e$ coprime to $\lambda(n)$, $$e^2\equiv1\mod\lambda(n)\text.$$ Reading the linked ...
2
votes
2answers
236 views

PRP, PRF and modular arithmetic

Are there any arithmetic or mathematical functions that can be used as PRPs or PRFs ? Since, Conventional block ciphers like AES are that are proven to be good PRPs are not based on mathematics but ...
2
votes
1answer
82 views

Implementation of modular arithmetic?

In FIPS 186-3 appendix D.2 "implementation of Modular Arithmetic", they show shortcuts for solving $$B = A \mod m$$ for select Curves. How would you go about determining a valid short cuts for the ...
2
votes
1answer
779 views

ECC - Point Addition/Point Multiplication

So I have a very beginner-esque knowledge of ECDSA and I'm trying to write something in python to take a private key and output the public key (Basically from what I understand just trying to do the ...
2
votes
1answer
173 views

Why encrypting with private and public keys produce the same result?

Let say $e = 5$, $n = 119$ and $d = 77$. If I encrypt, for example, $m=15$ I get: $$m_1 = m^e=15 ^ 5 \mod 119 = 36\qquad\text{and}\qquad m_2 =m^d= 15 ^ {77} \mod 119 = 36$$. Why? Is it always like ...
2
votes
2answers
173 views

How can I solve congruence modulo N?

I am trying to solve congruences of the form $$J_A \cdot a^e\equiv 1 \pmod n$$ where $n=pq$ for $p,q$ prime and $\gcd(e,\varphi(n))=\gcd(J_A,n)=1$ Solve for $a\in \mathbb{Z}$, in terms of $n,J_A$ ...
2
votes
2answers
145 views

Why are some $x$ coordinates unsuitable for an ECDSA generator point?

For Bitcoin's ECDSA curve (secp256k1, where $a=0$, $b=7$), why can't the generator point's first coordinate be $x=0$? That is, the point on the curve would be $(0,y)$ where $y$ satisfies $y^2 = 0^3 + ...
2
votes
2answers
91 views

Formal security of recycled random blinding in a Paillier scheme

This question is a follow-up/variant on a previous question. Supposing that we are trying to generate a large number of (indistinguishable) ciphertexts of a given plaintext and want to avoid the ...
2
votes
1answer
100 views

Roots in modulo field

I have a point $(X,Y)$ on an elliptical curve $E(a,b)$ where $a=-3$ and $B$ is a large number that is in hexadecimal from -51BD. To compress this point oficially in a program, we know that every $X$ ...
2
votes
1answer
172 views

Shamir Secret Sharing Modular Reduction

Say players use Shamir's secret sharing to share a value $k$ such that each player now holds $k_i$, a share of $k$. How can they securely compute $k \bmod m$ for some $m$. Of course they can ...
2
votes
1answer
241 views

Square roots, prime factorization

I´m stuck in my homework and since its homework, I would rather get some hints than full solution. The problem goes: factorize n = 88416763 in case that you know that the square roots of 51733469 ...
2
votes
4answers
1k views

Pseudocode for constant time modular exponentiation

I'm looking to implement modular exponentiation (for RSA) in constant time, but most of the examples I've found are more mathematical descriptions of the operations. Are there any references with ...
2
votes
1answer
81 views

Can I publish the accumulator trapdoor and still keep it secure?

I'm implementing the Camenish-Lysyanskaya dynamic accumulator. It seems to me that the accumulator is provably secure because the trapdoor is unknown to the attacker. The risks should be the fact ...
2
votes
1answer
610 views

RSA: Fermat's Little Theorem and the multiplicative inverse relationship between mod n and mod phi(n)

I'm learning about the proof of the RSA encryption algorithm, and I'm clearly fudging or missing something, because for me it doesn't add up. When generating keys for RSA encryption, we make sure ...
2
votes
1answer
257 views

Fast modular reduction

I am looking at ways to speed up modular reduction for the polynomial $$2^{256}-2^{32}-2^9-2^8-2^7-2^6-2^4-1$$ I have read the paper "Generalized Mersenne numbers" by J.A. Solinas, but it does not ...
2
votes
0answers
66 views

What happens if no final subtraction is done in Montgomery multiplication?

I'm doing Montgomery arithmetic modulo $N = 2^{255}-19$ for the Curve25519, picking $R = 2^{256}$ for Montgomery. After multiplying two numbers $0 <= A,B < N$ in the Montgomery representation ...
2
votes
0answers
125 views

Proxy re-encryption mod operations

I managed to implement the proxy re-encryption scheme from http://eprint.iacr.org/2009/189.pdf in Python 2.7, however I am having performance issues. As it is, I can run the algorithm for key sizes up ...
2
votes
0answers
119 views

Gallant-Lambert-Vanstone method

I am experimenting with the GLV method but cannot manage to get the right results according to the literature. I managed to find lambda, beta, split $K$ into $k_1$ and $k_2$ etc. for the curve I'm ...
1
vote
3answers
111 views

How does $g$ being a generator imply Diffie-Hellman's correctness?

In the Diffie-Hellman protocol for key exchange over an unsecured channel, we choose $p$ and $g$, where $g$ is a generator of $\mathbf{Z}_p^*$. However I want to know why this assumption makes the ...
1
vote
2answers
121 views

Three different numbers with x³=x mod p

p is a prime greater than 2 and $a \in \mathbb{Z}_p$. Why are there exactly three solutions for a³ = a mod p? Obviously 0 and 1 are both in $\mathbb{Z}$ and valid solutions, but that still means, ...
1
vote
3answers
988 views

How to calculate Modulo using a standard calculator for a one time pad encryption

I wrote a simple python script to preform one time pad encryption I would like to be able to decrypt the ciphertext by hand. In my script I use mod 26. This is how I was shown to calculate a mod ...
1
vote
1answer
260 views

modulo operations in crypto algorithms

Am not a mathematician. Every crypto specification I see uses the modulo operation. For example RSA - If $e$ is the public key and $m$ is the plaintext with a modulus $n$ - the cipher text is $c = ...