Questions tagged [public-key]

An asymmetric cipher is an encryption scheme using a pair of keys, one to encrypt and a second to decrypt a message. This way the encrypting key need not be kept secret to ensure a private communication. Similarly in public key authentication, the verification key can be public and the signing key private.

Filter by
Sorted by
Tagged with
0 votes
0 answers
53 views

RSA random key generation [duplicate]

How RSA keys are tested for primality if they are random generated? I imagine this could be time consuming task.
0 votes
1 answer
546 views

Kleopatra: What is the strongest and most popular cryptography standard for PGP

While setting up PGP for the first time, I am presented with various encryption standards I can use being: RSA (2048, 3072, 4096 bits) with an option for + RSA (2048, 3072, 4096 bits) DSA (2048 bits) ...
1 vote
2 answers
98 views

Efficiently detect that a ciphertext is meant for Alice

Assume we have the situation that Alice is receiving somewhere in the magnitude of 1_000_000 encrypted messages, whereby a small number (n<100 for 99% of cases) of these messages are meant for her. ...
0 votes
0 answers
53 views

Public key encryption with a large number of users

I'm building an app that will primarily be iOS or Android based. My plan is for every user to have their own key pair. The public key will be stored on the server along with a 128 bit UUID which is ...
0 votes
0 answers
35 views

Use secp384r1 PEM key to sign a Verifiable Credential with Linked Data proofs

Ok, let me preface this by clarifying that I am not a cryptographer by trade, but I've been using cryptographic suites in the context of signing w3c Verifiable Credentials, and I am not sure if this ...
0 votes
1 answer
29 views

Density in terms of knapsack public-key cryptosystems

I am quite new to knapsack cryptosystems (specifically the merkle-hellman cryptosystem) and don't quite understand what exactly is the density $d(a) = \frac{n}{\log_2max_i a_i}$ defined here among ...
1 vote
0 answers
23 views

Security notion for asymmetric encryption when used in oblivious transfer

This paper suggests the following approach to oblivious transfer (OT), using asymmetric encryption: Receiver generates keypair $(pk_b, sk)$, selects random $t$, and set $pk_{1 - b} = pk_b \oplus \...
7 votes
2 answers
5k views

What happens if an RSA key pair has identical public and private exponents?

Rather, is it possible for big prime numbers? Classroom examples usually involve smaller primes, so for example if you are given a prime number pair $p = 3$, $q = 13$ you would get $n = 39$ and $e = ...
1 vote
1 answer
158 views

Constantly changing encryption for transferring data

I had an idea for safely transmitting sensitive data online, and I wanted an expert opinion. Would it be safe to encrypt data (for simplicity at this point just use plain text) with a ruleset (an ...
0 votes
2 answers
101 views

Functional Encryption in Private-key setting vs. Public-key setting

$\bullet$ What does private-key functional encryption mean? Or functional encryption in private-key setting? Wasn't functional encryption a generalization of public key encryption? So now, why do we ...
20 votes
3 answers
13k views

Is it safe to create a public ID by hashing a private key?

In an application, a curve25519 private key is the only stable identifier for an individual. I don't have readily have access to the corresponding public key. Would it be safe to generate a public ...
3 votes
1 answer
318 views

How does key rotation work with DIDs (Decentralized Identifier)?

I've spent some time learning about DIDs but have some questions about key rotation: The way I understand it is that a DID and DID doc are generated from a public key derived from a private key. ...
4 votes
2 answers
560 views

Why does OpenSSL RSA signing process need the public exponent?

I am trying to fully separate RSA key pairs by breaking down $(N,e)$ for public part and $(N,d)$ for private part. From my understanding of RSA signature process, the message to be signed is digested ...
4 votes
1 answer
86 views

What does the "static" assumption mean?

We can prove the security of a cryptographic scheme in standard model and non-standard model. Standard models like using some computational assumptions, on the other hand, non-standard models like ...
0 votes
0 answers
53 views

Implementation of Ring Signature

I have implemented a ring signature in a Python program, To keep it simple, I have Alice and Bob. Based on this ring equation: $$ v = E_k(y_s⊕E_k(y_i⊕v))$$ I will get: $$ y_s = E_k^{-1}(v)⊕E_k(y_i⊕v) \...
2 votes
1 answer
108 views

Does using only one sign of secp256k1 publc keys weaken security?

As far as I understand, compressed public keys of secp256k1 can represent points either above or below the X axis, depending on whether they begin 0x02 or 0x03. Am I correct in thinking that if you ...
3 votes
1 answer
550 views

How brittle is the current public key encryption infrastructure

Edit: One half of the answer to this question also applies to a recently asked and now deleted question regarding the impact of an algorithm which breaks DLP over integers but has no impact on ...
151 votes
7 answers
110k views

Should we sign-then-encrypt, or encrypt-then-sign?

Frequently, we want to send messages that are (a) encrypted, so passive attackers can't discover the plaintext of the message, and (b) signed with a private-key digital signature, so active attackers ...
2 votes
0 answers
39 views

Which one is more general, attribute based encryption or inner product predicate encryption?

If we have a scheme for inner product predicate encryption (IPPE), then can we claim that we already have designed an attribute based encryption (ABE) scheme; So we do not need to design an ABE again. ...
1 vote
1 answer
151 views

js-ethereum-cryptography secp256k1 signature difficulties

I'm currently undertaking a course on Blockchain cryptography. And our first project is to transfer tokens from one wallet to another using client / server application. All mock of course. This ...
1 vote
3 answers
166 views

Proving identity in asymmetrically encrypted communication

Let's assume such a scenario. Person A will broadcast his public key and person B will broadcast his public key. They can now communicate. But let's say that suddenly another person C will write to ...
1 vote
1 answer
79 views

Changing the keys of an encrypted backup file

I have a series of backup files which are being generated daily and which I need to store encrypted. The files are to be used by bob as and when they need it. I am planning to use public key ...
0 votes
0 answers
62 views

Transportation Key (KEK)

I was studying about how to transport keys from one HSM environment to another and it came to me that I would need some sort of transportation key so the HSM keys would be double encrypted. How would ...
46 votes
3 answers
47k views

Where and how to store private keys in web applications for private messaging with web browsers

I am working on a web application enabling users to communicate over private messages which is just one part of the whole system. The main focus during my development process is to protect the privacy ...
2 votes
2 answers
248 views

Can we recover public key from DSA signatures as we can from ECDSA?

I learned the Public Key Recovery algorithm for ECDSA, and wonder if we can use it in DSA. The answer seems to be no, but details are welcome.
0 votes
0 answers
15 views

Bandwidth-Efficient Non-Repudiation

I'm working on a project that involves broadcast (uni-directional) streaming and requires non-repudiation. Essentially, a device broadcasts a data stream over the air, and any receiving station needs ...
3 votes
1 answer
129 views

Does CCA security require rejection?

It seems like every CCA-secure KEM1 has some sort of check that the decapsulator performs. Sometimes failure will result in rejection ("explicit rejection") or the decapsulator will simply ...
0 votes
0 answers
451 views

Private Key Signing in C# and Public Key Verifying in Java and Swift

I create this question from here. I am working on a project with C# backend and mobile apps using Java and Swift. I found this documentation to use RSACryptoServiceProvider.SignData method to sign ...
7 votes
2 answers
787 views

Is it reasonable to re-use a keypair across multiple systems that support the same public key signature system?

This question is relevant for both crypto stack exchange and infosec stack exchange. I thought I'd ask here to get answers from a cryptography perspective. If two systems use the same public key ...
1 vote
1 answer
86 views

Diffie-Hellman key exchange for $n + 1$ parties

Suppose that there are $n+1$ parties - $B,A_1,A_2,...,A_n$ that want to share a secret key The protocol of exchanging is roughly the same as Diffe-Hellman Chose a group $G$ with an order of $p$ - a ...
1 vote
2 answers
124 views

What is simple asymmetric encryption that use arbitrary key?

While XOR is used as simple symmetric encryption with arbitrary custom key, what is a simple asymmetric encryption that use arbitrary custom key? That means I want to be able to set custom private key ...
1 vote
1 answer
155 views

X.509 CA bundle content

I recently looked into the subject of public key cryptography (especially with X.509 certificates). I am the administrator of a web server using HTTPS which uses 2 levels of certificates (in addition ...
0 votes
2 answers
398 views

Are there any full alternatives to RSA that are quantum-resistant

By full alternatives I mean things that can do everything RSA can, namely establish secure security without privately sharing information prior. Something which AES can't do. In other words, I'm ...
0 votes
0 answers
22 views

Identity authentication in anonymous public key encryption

In a similar anonymous PKE based on D-H key exchange, in a many-to-one (one-to-many) case, is there any way to implement authentication without revealing the identity of the sender (receiver)? Could ...
1 vote
2 answers
2k views

Is there a way to get time from signature? Or is it possible to ensure the message was signed at the time that it says it was signed?

Suppose my server receives a message, the public key, and the signature. The message contains a time stamp. Is there a way to get the time stamp from the signature to match it with the message time ...
3 votes
1 answer
831 views

When using ECDSA P-384 for signing and verifying messages, should the public key be also included **INSIDE** the message before signing?

I am using ECDSA P-384 for signing and verifying messages. The messages are basically stringified JSON. After receiving, the recipient verifies the signature using the public key. Should the public ...
0 votes
0 answers
32 views

verifying that a private key can decrypt a payload in multi key encryption

If Bob takes a plaintext and encrypts it with their own public key and hands it to Eve who in turn encrypts it with her public key, we now have a cipher text that requires both Bob and Eve to decrypt ...
2 votes
1 answer
200 views

Digital signature with private key on exchange

I think I understand how asymmetric cryptography works. However I don't really understand why some exchanges use the signature generated by hashing the payload with the private key. From my ...
2 votes
2 answers
224 views

Can we extract public key from signature created by RSA?

I know it's possible with ECDSA. How bout RSA?
-3 votes
1 answer
144 views

why RSA public keys contains non-ascii characters?

let's look at the public key in this post as an example: https://crypto.stackexchange.com/a/35105 MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCqGKukO1De7zhZj6+H0qtjTkVxwTCpvKe4eCZ0FPqri0cb2JZfXJ/...
0 votes
0 answers
44 views

Symmetric and asymmetric encryption using the same encryption/decryption algorithm?

If we use the following notation: $$C = E(P, K_e)$$ $$P = D(C, K_d)$$ Where: $$E(), D(), C, P, K_e, K_d$$ are the encryption algorithm, decryption algorithm, ciphertext, plaintext, encryption key and ...
0 votes
0 answers
18 views

Group keys with revocation in publish/subscribe IoT

I have a group of subscribers who are subscribed to a message broker in an IoT setting, let's say to the topic 'sensor/temperature'. Now, I want to create a public/private key pair in such a way that ...
0 votes
0 answers
43 views

PKC (non Diffie-Hellman) from Graph Isomorphism

A Diffie Hellman style approach is proposed in https://mathoverflow.net/questions/408757/diffie-hellman-cryptography-based-on-graph-isomorphism but is broken easily. Two graphs are isomorphic iff ...
0 votes
0 answers
38 views

DES encryption Key from a passphrase

I have been given a DES encryption assignment. I was given the Cipher text, the Plain text and the "passphrase". The passphrase consist of a 4 byte hex string. I have studied several ...
1 vote
1 answer
49 views

Hiding and binding property of Goldwasser-Micali like bit commitment scheme

Let $N=pq$ be an RSA modulus, that is, $p$ and $q$ are large, distinct primes. Let $J_{N}=\{y\in\mathbb{Z}^{*}_{N}:(\frac{y}{N})_{J}=1\}$ denote the set of all integers in $\mathbb{Z}^{*}_{N}$ with ...
4 votes
1 answer
226 views

Is it possible to forge a RSA signature with a known public key, hardcoded padding, and unlimited oracle information?

I'm doing vulnerability research and looking at a device that is using some u-boot RSA encryption that they've modified. I've extracted the 4096-bit public key from the flash, it has an exponent of <...
4 votes
2 answers
158 views

Why NIST 800-56A rev3 does not use cross secret calculation in C(2e, 2s, ECC CDH) scheme?

In the NIST 800-56A rev3 "Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography" in section 6.1.1.2 "(Cofactor) Full Unified Model, C(2e, 2s, ECC ...
5 votes
1 answer
334 views

Why is an ephemeral key required to prove possession of a static private key in Key-Establishment Schemes

In the NIST 800-56A rev3 "Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography" in section 5.6.2.2.3.2 "Recipient Obtains Assurance [of the ...
2 votes
0 answers
47 views

Claims about universally composable oblivious transfer, which ones are correct?

There are two papers that propose oblivious transfer protocols, both claiming to be universally composable (UC). The first protocol is more complex, and I am convinced that it is indeed UC. The second ...
1 vote
0 answers
297 views

JavaScript SubtleCrypto - Is there a way to convert the ECDSA keys into a more "portable" format and preferably shorter? [closed]

I asked this question on StackOverflow but it seems like it's more appropriate for this Crypto community. I am using the browser built in SubtleCrypto library in javascript to generate public and ...

1 2
3
4 5
47