An asymmetric cipher is an encryption scheme using a pair of keys, one to encrypt and a second to decrypt a message. A special class of asymmetric ciphers are public-key ciphers, in which the encrypting key need not be kept secret to ensure a private communication.

learn more… | top users | synonyms (3)

7
votes
2answers
603 views

How does Clifford Cocks 'Non-Secret Encryption' work?

I have read Clifford Cocks "A Note on 'Non-secret Encryption'" and thought I would try to implement this, but I don't seem to be able to get it to work. I'm obviously missing something. From the ...
7
votes
1answer
2k views

How do other, non-RSA algorithms, compare to the PKCS #1 standard?

Arguably the PKCS suite of standards have a profit-oriented bias as they are promoted by RSA and promote their algorithms over others in the form of RFCs and other means. I'm considering the ...
7
votes
2answers
541 views

Implement deniable encryption with AES/RSA

I'm on a crypto app using OpenSSL (I'm more an implementer/cryptographer than a cryptologist), mainly as a hobby, for now. My app will be able to encrypt a file (not a container) with symmetric or ...
7
votes
1answer
3k views

Why is Diffie-Hellman considered in the context of public key cryptography?

In all textbooks I used the Diffie-Hellman key exchange is under "public key cryptography". As far as I can see it is a method to exchange a key to be used with a symmetric cryptographic algorithm, ...
7
votes
1answer
1k views

How can I determine the GPG/PGP key ID from the RSA modulus?

According to http://www.pgp.net/pgpnet/pgp-faq/pgp-faq-keys.html#key-public-key-forgery, key ID is some lower bits sequence from the modulus (i.e. the $n$ variable): A PGP key ID is just the ...
7
votes
0answers
330 views

Security of RSA for paranoids with padding?

RSA for Paranoids (RSAP) (in cryptobytes v3n1), also known as Unbalanced RSA, is a variant of RSA proposed in 1995 by Adi Shamir, as a mean to increase the RSA public modulus size while keeping ...
6
votes
4answers
2k views

Why is it important that phi(n) is kept a secret, in RSA?

Why is it important that $\phi(n)$ is kept a secret, in RSA?
6
votes
3answers
402 views

Why the symmetric key layer in PGP?

I've been familiarizing myself with the basics of PGP. If I understand correctly, PGP symmetrically encrypts the data of interest using a random single-use key, then encrypts the encrypted data and ...
6
votes
5answers
780 views

Applications of Group Ciphers

I've been reading a paper [1], and I've ran across something called a "Group Cipher", which is similar to homomorphic encryption, with an important difference. In homomorphic encryption we have an ...
6
votes
5answers
4k views

Why do we need asymmetric algorithms for key exchange?

In SSL protocols, both symmetric and asymmetric algorithms are used. Why is it so? The symmetric algorithms are more secure and easier to implement. Why are asymmetric algorithms usually preferred in ...
6
votes
3answers
1k views

Is sharing the modulus for multiple RSA key pairs secure?

In the public-key system RSA scheme, each user holds beyond a public modulus $m$ a public exponent, $e$, and a private exponent, $d$. Suppose that Bob's private exponent is learned by other users. ...
6
votes
2answers
7k views

How much computing resource is required to brute-force RSA?

It's been over 30 years since Rivest, Shamir and Adleman first publicly described their algorithm for public-key cryptography; and the intelligence community is thought to have known about it for ...
6
votes
1answer
2k views

Advantages using Diffie-Hellman or Elgamal

For what kind of usage should we prefer using Diffie-Hellman in order to exchange keys instead of Elgamal, and most important why should we use one or the other? I do not see a clear difference ...
6
votes
1answer
1k views

Is a known plaintext, ciphertext, and public-key a viable attack on RSA?

Assume Alice and Bob are using RSA to create a common session key and Cindy is listening, attempting to obtain the session key. Alice and Bob each have their public- and private-key pairs ...
6
votes
3answers
2k views

Why can't Diffie-Hellman be used for signing?

I understand that signing is often a case of hashing data and then encrypting the hash with the private key. What properties keep Diffie-Hellman from being useful for this?
6
votes
2answers
5k views

How does a chosen plaintext attack on RSA work?

How can one run a chosen plaintext attack on RSA? If I can send some plaintexts and get the ciphertexts, how can I find a relation between them which helps me to crack another ciphertext?
6
votes
4answers
3k views

How are timestamps verified?

You put an input and the hash value comes as an output then when someone puts the input the hash function it is applied to see if it is the same hash original value is stored in some database , that ...
6
votes
1answer
366 views

Perfect Forward Secrecy with NaCl

I would like to use the NaCl cryptography library (or TweetNaCl), but I would very much like to have perfect forward secrecy for my application. From what I understand, all Bob needs to to decrypt a ...
6
votes
1answer
1k views

Knowing pre-encryption data, can we find the private key CryptoLocker used?

One of our users seems to have been hit by CryptoLocker. As a result, he has a hard drive full of encrypted files. The ransom-ware claims to have used public key encryption on the files. If we know ...
6
votes
2answers
2k views

How can I remove my personal data from my PGP public key?

According to this Q&A-discussion it is possible to remove all personal data (name and mail address) that is attached to a public key. What steps do I have to follow in order to remove all ...
6
votes
2answers
406 views

For public-key encryption, why does COA resistance imply CPA resistance?

My professor told me: If a public-key crypto-system is secure against ciphertext-only attacks, then it is also secure against a chosen-plaintext attack. Why is this true? Is there a proof that ...
6
votes
1answer
143 views

Are there groups where the computational Diffie Hellman problem is easy but the discrete log problem is hard?

I know that there are elliptic curve groups, used in pairing-based cryptography, where the decisional Diffie Hellman problem (ie. given $g$, $g^a$, $g^b$ and $c$, determine if $c = g^{ab}$ is easy but ...
6
votes
3answers
613 views

Security equivalence proofs for breaking RSA

It is my understanding that while a practical solution to the factoring problem will definitely break RSA, it has never been proven that the security of RSA is equivalent to factoring. In otherwords, ...
6
votes
1answer
1k views

Is a private RSA key vulnerable to a chosen plaintext encrypted with that private key?

I grasp that having known plaintext encrypted with the public key doesn't provide a means of discovering the private key (that being the whole point...). But if one were in a situation where they ...
6
votes
1answer
127 views

In a lattice, how can one define a good basis and a bad basis?

When it comes to lattice based cryptographic systems, all the literature talks about, good bases and bad bases. How does one define what a good basis is and what a bad basis is?
6
votes
0answers
149 views

Verbatim of early work on public-key cryptography?

In late 1997, the history of public-key cryptography was turned around with the announcement by the CESG (April 2000 archive) that public-key cryptography was theorized in a 1970 note [1] by James ...
5
votes
3answers
1k views

What is Identity-Based Encryption (IBE) and why is it “better”?

Most CS/Math undergrads run into the well-known RSA cryptosystem at some point. But about 10 years ago Boneh and Franklin introduced a practical Identity-Based Encryption system (IBE) that has ...
5
votes
3answers
2k views

What is the importance of Modular arithmetic in cryptography?

Why do we use modular arithmetic so often in Cryptography?
5
votes
2answers
976 views

Can a computationally unbounded adversary break any public-key encryption scheme?

Assume there is a public-key encryption scheme $(KeyGen, Enc, Dec)$ with perfect correctness (i.e., for all messages M and valid key-pairs (PK,SK), we have $Dec_{SK}(Enc_{PK}(M))=M$). Will there ...
5
votes
6answers
632 views

Is there an authenticated encryption scheme where the recipient can attribute the message to a single sender?

With a standard authenticated encryption scheme (or MAC), Alice and Bob share a symmetric key. When Alice sends something to Bob, Bob can check that it is authentic. At that point, Bob can deduce ...
5
votes
3answers
671 views

How can one sign with NTRU?

I am looking at implementing NTRU, but I noticed that while the encryption/decryption algorithm seems to be mature and well-documented, there is comparatively little information about how to sign ...
5
votes
4answers
1k views

Is it possible to create an open-source SecurID?

As far as I understand it, the hardware key-fob two-factor systems such as RSA SecurID depend on secret algorithms, and employ tamper-resistant hardware to prevent reverse engineering. Is there some ...
5
votes
3answers
325 views

What other one-way functions are used in cryptosystems?

For RSA and El Gamal (and most other public key cryptosystems), one of the key ideas is that factoring and finding discrete logarithms are hard. There are other systems that rely on certain properties ...
5
votes
3answers
1k views

Why should the RSA private exponent have the same size as the modulus?

Consider the generation of an RSA key pair with a given modulus size $n$ and a known, small public exponent $e$ (typically $e = 3$ or $e = 65537$). A common method is to generate two random primes ...
5
votes
2answers
365 views

Is RSA encryption of a cryptographic hash with a private key the same as signature generation?

It is often said that RSA encryption with a private key is the same as signing (signature generation). Will RSA encryption with a private key over a cryptographic hash give the same result as ...
5
votes
1answer
1k views

Can you explain Bleichenbacher's CCA attack on PKCS#1 v1.5?

I've studied that the Bleichenbacher's CCA attack on PKCS#1 v1.5. is a base to many versions of attacks in the area. I'm trying to understand that attack, but every explanation I saw starts with the ...
5
votes
2answers
4k views

In RSA, do I calculate d from e or e from d?

In the original paper introducing RSA, it is implied that one should first choose $d$ and then calulate $e$ from $p$, $q$, and $d$. However, I have found in other places (such as the wikipedia article ...
5
votes
1answer
2k views

Low Public Exponent Attack for RSA

I'm having trouble understanding the algorithm for finding the original message $m$, when there is a small public exponent. Here is the example I'm trying to follow (you can also read it in the 'Low ...
5
votes
1answer
817 views

In RSA encryption, does the value of e need to be random?

I am a novice programmer and am just finishing up an RSA encryption program that I am writing for practice. Currently I have the program generate a relatively small random value for the public key e. ...
5
votes
2answers
876 views

How do I solve this RSA instance for m?

How we can solve this equation and get the value of M? $$8 = M^{13} \mod 33$$ not a computer program, but a mathematical operation.
5
votes
2answers
730 views

Is a RSA-signature of some identifying data a safe way to implement a license key?

I have this idea of implementing a license key: After the user downloads the program, he connects to a website and sends his Windows product ID. The website, then, sends this back to him with a ...
5
votes
2answers
635 views

Random Coin Flip using ElGamal and a Trusted Party

An old exam question I am trying to figure out: Consider the following protocol for two parties to flip a fair coin. Trusted party T publishes her public key pk A chooses a random bit ...
5
votes
3answers
371 views

What are some good references for the implementation weaknesses in RSA

I'm pretty sure I understand textbook RSA. Choose p and q, large primes, and compute n=pq. Choose e such that $gcd(\phi(n),e)=1.$ Publish n and e. Compute d such that $de=1$ (mod $\phi(n)$). To ...
5
votes
1answer
130 views

Discovering private exponent from public key

I'm going to assume this isn't possible, but I have to ask because I'm trying to fundamentally understand what I've thus far been trying to implement by following an RFC. SRP-6a starts off with ...
5
votes
1answer
1k views

Get RSA PlainText without Knowing Private Key

If I have an algorithm,RSA-Crack(), that, for a given RSA public key (n,e), is able to decrypt 1% of the messages encrypted with that key (without knowledge of the corresponding private key).Can there ...
5
votes
1answer
500 views

What is the harm if I publish an encrypted RSA private key publicly?

What is the harm if I publish an encrypted RSA private key publicly? Or in this case, what is the harm if I publish many thousands or millions of them? Assuming that the private key is encrypted ...
5
votes
1answer
316 views

How are trapdoor functions developed/found and where can I find existing ones?

Trapdoor functions are a fundamental part of public key cryptography. An example of the most common trapdoor is Prime Factorization, used in cryptosystems such as RSA How are these trapdoor ...
5
votes
1answer
259 views

How can I take advantage of repeated patterns in non random RSA prime factors?

I am researching vulnerable RSA moduli which are composed of primes generated with poor entropy. Having a list of these primes I searched for variable sized repeated patterns among them and I noticed ...
5
votes
1answer
441 views

Proof that padded RSA is CPA-secure

I'm referring to page 383 of J. Katz and Y. Lindell's Introduction to Modern Cryptography. The book presents a padded RSA: ${\bf Key Generation:}$ same as Textbook RSA (given security parameter ...
5
votes
1answer
1k views

Is this design of client side encryption secure?

I want to build a secure file storage web application. Users should be sure that server doesn't know how to decrypt files so encryption should take place at client side (i.e. in Javascript) and TLS ...