An asymmetric cipher is an encryption scheme using a pair of keys, one to encrypt and a second to decrypt a message. A special class of asymmetric ciphers are public-key ciphers, in which the encrypting key need not be kept secret to ensure a private communication.

learn more… | top users | synonyms (3)

8
votes
2answers
500 views

Why does key generation take an input $1^k$, and how do I represent it in practice?

In my lecture, the lecturer said: Let $K$ be the key generation algorithm. Given a security parameter represented in unary, $1^k$, $K(1^k)$ will output a keypair $(pk; sk)$, known as the public ...
8
votes
3answers
396 views

Can one have an authentic, but repudiable, message without a previously shared secret?

Bob wants to send a message to Alice, such that Alice can be sure that the message came from Bob, but can't prove it to anyone else. If I understand right, this means that the same message could have ...
8
votes
3answers
838 views

Are there asymmetric cryptographic algorithms that are not based on integer factorization and discrete logarithm?

In the computer security class (in which cryptography is a big chapter) that I took, I remembered the professor said about current asymmetric cryptography algorithms are based on integer factorization ...
8
votes
1answer
3k views

Multi-party encryption algorithm

To give some foreground information: I acknowledge that I am a cryptography newb and not by any means an expert (and probably never will be). In a recent CS class we had several assignments writing ...
8
votes
2answers
2k views

Cycle attack on RSA

I originally posted this question in the mathematics section, you can see it here. Let $p$ and $q$ be large primes, $n=pq$ and $e : 0<e<\phi(n), \space gcd(e, \phi(n))=1$ the public encyption ...
8
votes
4answers
475 views

Can an encryption method be used as a hash function?

As I understand, there are a few requirements for a good hash function. Hard to find any message from a given hash Hard to find any 2 messages which give the same hash A single bit change in the ...
8
votes
1answer
398 views

Exposing RSA private-key data… bad?

We know that exposing $p$, or $q$ or $\phi(n)$ results in trivial attacks on RSA since they allow us to factor $n$ and to compute the private exponent $d$. In OpenSSL (and most RSA implementations) ...
8
votes
3answers
421 views

Is there an algorithm to find the number of intersections of two sets?

Suppose both I and my friend have a set of integer numbers. We want to know the number of common elements in our two sets but without knowing elements of the sets of each other. So I don't want my ...
8
votes
1answer
363 views

Alice trusts Bob only when Bob trusts Alice

some story first: Alice and Bob both have public/private key pairs. Now Bob wants Alice to sign his public key id. Alice agrees but only when Bob signs the public key id of her. Is this something ...
8
votes
4answers
363 views

Is there a public key encryption scheme with optimal key size?

Symmetric encryption schemes such as AES have known security levels equal to their key sizes (i.e. breaking an encryption with an $n$ bit key needs about $2^n$ work steps). Elliptic curve encryption ...
8
votes
1answer
211 views

Signature to prove of ownership of arbitrary sized data

I am familiar with public key signatures, but I was wondering if there is a method to accomplish the following. Suppose I publish a file (say a PDF article) on a peer to peer network. How can I ...
8
votes
1answer
162 views

Proof of Communication

I desire an algorithm in which Alice sends a block of data $X$ to Bob, with proof that the data was both sent and received. Ideally this would take the form of a public-key signature of the block $X$ ...
8
votes
1answer
169 views

Is the Couvreur et al. polynomial time attack on McEliece practical?

There's a new e-print out on arXiv titled "A Polynomial Time Attack against Algebraic Geometry Code Based Public Key Cryptosystems" by Alain Couvreur, Irene Márquez-Corbella and Ruud Pellikaan: ...
8
votes
1answer
93 views

Could this “symmetric RSA” scheme provide key compromise resistant communications?

This question, and fkraiem's answer to it, made me wonder about the security and practicality of using "symmetric RSA" to provide a partially compromise-resistant secure channel. Specifically, assume ...
7
votes
5answers
898 views

Applications of Group Ciphers

I've been reading a paper [1], and I've ran across something called a "Group Cipher", which is similar to homomorphic encryption, with an important difference. In homomorphic encryption we have an ...
7
votes
4answers
273 views

What is stopping someone from saving encrypted info, and decoding it later?

When I send encrypted data to a website, using public key encryption, what is stopping someone who is listening from storing my encrypted data, and decryption it in a few years after they have ...
7
votes
5answers
6k views

Why do we need asymmetric algorithms for key exchange?

In SSL protocols, both symmetric and asymmetric algorithms are used. Why is it so? The symmetric algorithms are more secure and easier to implement. Why are asymmetric algorithms usually preferred in ...
7
votes
3answers
3k views

Is sharing the modulus for multiple RSA key pairs secure?

In the public-key system RSA scheme, each user holds beyond a public modulus $m$ a public exponent, $e$, and a private exponent, $d$. Suppose that Bob's private exponent is learned by other users. ...
7
votes
1answer
4k views

Advantages using Diffie-Hellman or ElGamal

For what kind of usage should we prefer using Diffie-Hellman in order to exchange keys instead of ElGamal, and most important why should we use one or the other? I do not see a clear difference ...
7
votes
2answers
11k views

How much computing resource is required to brute-force RSA?

It's been over 30 years since Rivest, Shamir and Adleman first publicly described their algorithm for public-key cryptography; and the intelligence community is thought to have known about it for ...
7
votes
1answer
3k views

Generating Random Primes

Although this has been extensively discussed around here, I'm curious whether my approach makes sense, or I should just stick to "the standard version". I'm implementing some homomorphic encryption ...
7
votes
1answer
4k views

Low Public Exponent Attack for RSA

I'm having trouble understanding the algorithm for finding the original message $m$, when there is a small public exponent. Here is the example I'm trying to follow (you can also read it in the 'Low ...
7
votes
2answers
702 views

How does Clifford Cocks 'Non-Secret Encryption' work?

I have read Clifford Cocks "A Note on 'Non-secret Encryption'" and thought I would try to implement this, but I don't seem to be able to get it to work. I'm obviously missing something. From the ...
7
votes
1answer
3k views

How do other, non-RSA algorithms, compare to the PKCS #1 standard?

Arguably the PKCS suite of standards have a profit-oriented bias as they are promoted by RSA and promote their algorithms over others in the form of RFCs and other means. I'm considering the ...
7
votes
1answer
2k views

Knowing pre-encryption data, can we find the private key CryptoLocker used?

One of our users seems to have been hit by CryptoLocker. As a result, he has a hard drive full of encrypted files. The ransom-ware claims to have used public key encryption on the files. If we know ...
7
votes
2answers
639 views

Implement deniable encryption with AES/RSA

I'm on a crypto app using OpenSSL (I'm more an implementer/cryptographer than a cryptologist), mainly as a hobby, for now. My app will be able to encrypt a file (not a container) with symmetric or ...
7
votes
1answer
2k views

How can I determine the GPG/PGP key ID from the RSA modulus?

According to http://www.pgp.net/pgpnet/pgp-faq/pgp-faq-keys.html#key-public-key-forgery, key ID is some lower bits sequence from the modulus (i.e. the $n$ variable): A PGP key ID is just the ...
7
votes
0answers
177 views

Verbatim of early work on public-key cryptography?

In late 1997, the history of public-key cryptography was turned around with the announcement by the CESG (April 2000 archive) that public-key cryptography was theorized in a 1970 note [1] by James ...
7
votes
0answers
423 views

Security of RSA for paranoids with padding?

RSA for Paranoids (RSAP) (in cryptobytes v3n1), also known as Unbalanced RSA, is a variant of RSA proposed in 1995 by Adi Shamir, as a mean to increase the RSA public modulus size while keeping ...
6
votes
3answers
457 views

Why the symmetric key layer in PGP?

I've been familiarizing myself with the basics of PGP. If I understand correctly, PGP symmetrically encrypts the data of interest using a random single-use key, then encrypts the encrypted data and ...
6
votes
2answers
1k views

Can a computationally unbounded adversary break any public-key encryption scheme?

Assume there is a public-key encryption scheme $(KeyGen, Enc, Dec)$ with perfect correctness (i.e., for all messages M and valid key-pairs (PK,SK), we have $Dec_{SK}(Enc_{PK}(M))=M$). Will there ...
6
votes
5answers
6k views

What is the SSL private key file format?

I was researching about how to encrypt with RSA. I understood everything but not the format of the private keys. In the phpseclib (RSA in PHP), you can import your private key (private.key format) ...
6
votes
3answers
2k views

Why should the RSA private exponent have the same size as the modulus?

Consider the generation of an RSA key pair with a given modulus size $n$ and a known, small public exponent $e$ (typically $e = 3$ or $e = 65537$). A common method is to generate two random primes ...
6
votes
4answers
4k views

How are timestamps verified?

You put an input and the hash value comes as an output then when someone puts the input the hash function it is applied to see if it is the same hash original value is stored in some database , that ...
6
votes
3answers
6k views

In RSA, do I calculate d from e or e from d?

In the original paper introducing RSA, it is implied that one should first choose $d$ and then calulate $e$ from $p$, $q$, and $d$. However, I have found in other places (such as the wikipedia article ...
6
votes
2answers
873 views

Random Coin Flip using ElGamal and a Trusted Party

An old exam question I am trying to figure out: Consider the following protocol for two parties to flip a fair coin. Trusted party T publishes her public key pk A chooses a random bit ...
6
votes
2answers
3k views

How can I remove my personal data from my PGP public key?

According to this Q&A-discussion it is possible to remove all personal data (name and mail address) that is attached to a public key. What steps do I have to follow in order to remove all ...
6
votes
1answer
2k views

Is a known plaintext, ciphertext, and public-key a viable attack on RSA?

Assume Alice and Bob are using RSA to create a common session key and Cindy is listening, attempting to obtain the session key. Alice and Bob each have their public- and private-key pairs ...
6
votes
2answers
4k views

Why DSA cannot be used for encryption?

Here it is mentioned that DSA cannot be used for encrypt. But Both RSA and DSA can be used to generate public and private keys, right? (Or am I wrong?). Then why can't I use the DSA public key to ...
6
votes
1answer
2k views

how to use common modulus attack?

I am struck with the following problem: Let Alice, Bob, Chris and Eve communicate over a public network. They encrypt all messages they send using RSA system. Bob and Chris have the RSA modulus ...
6
votes
1answer
1k views

In RSA encryption, does the value of e need to be random?

I am a novice programmer and am just finishing up an RSA encryption program that I am writing for practice. Currently I have the program generate a relatively small random value for the public key e. ...
6
votes
3answers
3k views

Why can't Diffie-Hellman be used for signing?

I understand that signing is often a case of hashing data and then encrypting the hash with the private key. What properties keep Diffie-Hellman from being useful for this?
6
votes
2answers
7k views

How does a chosen plaintext attack on RSA work?

How can one run a chosen plaintext attack on RSA? If I can send some plaintexts and get the ciphertexts, how can I find a relation between them which helps me to crack another ciphertext?
6
votes
1answer
157 views

Secure, patent-free alternative to NTRU

I'm working on a P2P communications and chat framework, and am looking for a quantum-secure asymmetric key exchange algorithm which I can use to perform a key exchange of an AES-256 bit key. This is ...
6
votes
2answers
464 views

For public-key encryption, why does COA resistance imply CPA resistance?

My professor told me: If a public-key crypto-system is secure against ciphertext-only attacks, then it is also secure against a chosen-plaintext attack. Why is this true? Is there a proof that ...
6
votes
3answers
8k views

What makes RSA secure by using prime numbers?

I am just learning about the RSA algorithm. Looking at the first two steps: Choose two distinct prime numbers $p$ and $q$. Compute $n = pq$. I have some probably stupid questions: Why do $p$ ...
6
votes
1answer
133 views

When/why is RSA (hybrid) encryption used rather than alternatives?

I've read that RSA is not meant for encrypting large plaintext because: (Are these also true for other public-key encryptions like ElGamal?) It is slow. Padding makes the ciphertext blocks much ...
6
votes
1answer
104 views

What is the difference between RCCA and CCA2?

Well, I know it's easy to tell CCA1 from CCA2, but I failed to find the difference between RCCA and CCA2. What is the difference?
6
votes
1answer
359 views

Why do we encrypt-then mac but sign-then-encrypt?

This question was asked in comments on my answer to should we sign then encrypt or encrypt then sign. I think posing the question as a separate entity is best, so: The general advice for applying ...
6
votes
1answer
157 views

Are there groups where the computational Diffie Hellman problem is easy but the discrete log problem is hard?

I know that there are elliptic curve groups, used in pairing-based cryptography, where the decisional Diffie Hellman problem (ie. given $g$, $g^a$, $g^b$ and $c$, determine if $c = g^{ab}$ is easy but ...