An asymmetric cipher is an encryption scheme using a pair of keys, one to encrypt and a second to decrypt a message. A special class of asymmetric ciphers are public-key ciphers, in which the encrypting key need not be kept secret to ensure a private communication.

learn more… | top users | synonyms (3)

6
votes
2answers
93 views

Is there a theorem to determine the elliptic curve parameters based on the group order?

By Hasse's theorem we know that range of the group order of the elliptic curve. And similarly, there exist a theorem on the admissible order of elliptic curves. Suppose by the theorem on the ...
6
votes
1answer
199 views

Secure, patent-free alternative to NTRU

I'm working on a P2P communications and chat framework, and am looking for a quantum-secure asymmetric key exchange algorithm which I can use to perform a key exchange of an AES-256 bit key. This is ...
6
votes
2answers
488 views

For public-key encryption, why does COA resistance imply CPA resistance?

My professor told me: If a public-key crypto-system is secure against ciphertext-only attacks, then it is also secure against a chosen-plaintext attack. Why is this true? Is there a proof that ...
6
votes
2answers
139 views

The difficulty of computing discrete logs

I understand that in Diffie-Hellman it should be hard to compute $a$ given $g$ and $g^a$. In computational Diffie-Hellman, it appears to be hard to compute $(g^{ab})$ from $g^a$ and $g^b$. As for ...
6
votes
1answer
122 views

What is the difference between RCCA and CCA2?

Well, I know it's easy to tell CCA1 from CCA2, but I failed to find the difference between RCCA and CCA2. What is the difference?
6
votes
1answer
425 views

Why do we encrypt-then mac but sign-then-encrypt?

This question was asked in comments on my answer to should we sign then encrypt or encrypt then sign. I think posing the question as a separate entity is best, so: The general advice for applying ...
6
votes
1answer
162 views

Are there groups where the computational Diffie Hellman problem is easy but the discrete log problem is hard?

I know that there are elliptic curve groups, used in pairing-based cryptography, where the decisional Diffie Hellman problem (ie. given $g$, $g^a$, $g^b$ and $c$, determine if $c = g^{ab}$ is easy but ...
6
votes
2answers
467 views

Can an RSA public key be generated without ever knowing the factors? [duplicate]

Context: http://blog.cryptographyengineering.com/2013/12/a-few-more-notes-on-nsa-random-number.html Assume I wanted to use RSA as the basis for a hash function or DRBG. Also assume that my construct ...
6
votes
1answer
419 views

Single Party Encryption, Multi Party Decryption

I am looking for an adequate protocol for public key decryption, which would allow $n$ parties to jointly decrypt a cipher text. The usage scenario for such a protocol would be a mixnet that wouldn't ...
6
votes
3answers
659 views

Security equivalence proofs for breaking RSA

It is my understanding that while a practical solution to the factoring problem will definitely break RSA, it has never been proven that the security of RSA is equivalent to factoring. In otherwords, ...
6
votes
1answer
2k views

Is a private RSA key vulnerable to a chosen plaintext encrypted with that private key?

I grasp that having known plaintext encrypted with the public key doesn't provide a means of discovering the private key (that being the whole point...). But if one were in a situation where they ...
6
votes
1answer
663 views

Proof that padded RSA is CPA-secure

I'm referring to page 383 of J. Katz and Y. Lindell's Introduction to Modern Cryptography. The book presents a padded RSA: ${\bf Key Generation:}$ same as Textbook RSA (given security parameter ...
6
votes
1answer
622 views

What is the harm if I publish an encrypted RSA private key publicly?

What is the harm if I publish an encrypted RSA private key publicly? Or in this case, what is the harm if I publish many thousands or millions of them? Assuming that the private key is encrypted ...
6
votes
1answer
188 views

In a lattice, how can one define a good basis and a bad basis?

When it comes to lattice based cryptographic systems, all the literature talks about, good bases and bad bases. How does one define what a good basis is and what a bad basis is?
5
votes
3answers
715 views

Is it possible to reduce the size of an RSA key?

The details about what an RSA key is made up of are explained succinctly here. Is it possible to reduce the amount of data that's usually packaged with the (private) key and then derive it later?
5
votes
3answers
3k views

What is Identity-Based Encryption (IBE) and why is it “better”?

Most CS/Math undergrads run into the well-known RSA cryptosystem at some point. But about 10 years ago Boneh and Franklin introduced a practical Identity-Based Encryption system (IBE) that has ...
5
votes
3answers
879 views

How can one sign with NTRU?

I am looking at implementing NTRU, but I noticed that while the encryption/decryption algorithm seems to be mature and well-documented, there is comparatively little information about how to sign ...
5
votes
6answers
961 views

Is there an authenticated encryption scheme where the recipient can attribute the message to a single sender?

With a standard authenticated encryption scheme (or MAC), Alice and Bob share a symmetric key. When Alice sends something to Bob, Bob can check that it is authentic. At that point, Bob can deduce ...
5
votes
3answers
2k views

How to perform authentication without central server in P2P?

How can one be sure that the man who you're talking with is the one who you think he is? i.e. How can one perform authentication in P2P network without a central trust server or Certificate Authority? ...
5
votes
4answers
1k views

Is it possible to create an open-source SecurID?

As far as I understand it, the hardware key-fob two-factor systems such as RSA SecurID depend on secret algorithms, and employ tamper-resistant hardware to prevent reverse engineering. Is there some ...
5
votes
3answers
333 views

What other one-way functions are used in cryptosystems?

For RSA and El Gamal (and most other public key cryptosystems), one of the key ideas is that factoring and finding discrete logarithms are hard. There are other systems that rely on certain properties ...
5
votes
2answers
737 views

Is RSA encryption of a cryptographic hash with a private key the same as signature generation?

It is often said that RSA encryption with a private key is the same as signing (signature generation). Will RSA encryption with a private key over a cryptographic hash give the same result as ...
5
votes
4answers
2k views

Is it possible to pick your Ed25519 public key?

Is it possible to generate an Ed25519 keypair that has a very similar public key as another keypair (fooling a casual visual comparison) or is this as hard as solving one of SHA-512 or the discrete ...
5
votes
2answers
608 views

Can we use elliptic curve cryptography in wireless sensors?

Can we use elliptic curve cryptography in wireless sensors? If so, how do you map points to message characters?
5
votes
1answer
3k views

Can an RSA private key have several public keys?

Ok, so my crpto lecturer in Uni posed this question at the end of the RSA key generation lecture as a brain teaser. I have been thinking about this and I think I have come up with a way ( I am aware ...
5
votes
2answers
1k views

How do I solve this RSA instance for m?

How we can solve this equation and get the value of M? $$8 = M^{13} \mod 33$$ not a computer program, but a mathematical operation.
5
votes
2answers
877 views

Is a RSA-signature of some identifying data a safe way to implement a license key?

I have this idea of implementing a license key: After the user downloads the program, he connects to a website and sends his Windows product ID. The website, then, sends this back to him with a ...
5
votes
2answers
103 views

Leading 00 in RSA public/private key file

I found these following values ALWAYS have the leading 00 in public/private key, public key: modulus private key: modulus, p,q, d mod (p-1), d mod (q-1), coefficient e.g., modulus ...
5
votes
3answers
570 views

What are some good references for the implementation weaknesses in RSA

I'm pretty sure I understand textbook RSA. Choose p and q, large primes, and compute n=pq. Choose e such that $gcd(\phi(n),e)=1.$ Publish n and e. Compute d such that $de=1$ (mod $\phi(n)$). To ...
5
votes
1answer
306 views

Why does RSA give better security on longer messages?

I am trying to understand the notion of RSA security. Choosing a public exponent where $e = 3$ facilitates the calculations, considering that it is secure if the plaintext or message is long. If the ...
5
votes
1answer
191 views

Authentication by hardcoding public key in client software

It would seem to me that mobile applications could reduce network traffic by hardcoding the server's public key into the app. The idea being that they could then encipher a secret to share with the ...
5
votes
1answer
159 views

When/why is RSA (hybrid) encryption used rather than alternatives?

I've read that RSA is not meant for encrypting large plaintext because: (Are these also true for other public-key encryptions like ElGamal?) It is slow. Padding makes the ciphertext blocks much ...
5
votes
2answers
10k views

The modulus of RSA public key

I am studying the RSA cryptosystem. The public key consists of $(n, e)$, the modulus (product of two large primes), and the encryption exponent. I want to separate the modulus $n$ and exponent $e$. A ...
5
votes
1answer
77 views

Do asymmetric signatures require constant-time verification?

To avoid a timing attack, HMAC signatures are usually compared in constant-time (every byte is compared, and the results aggregated). Is the same necessary for asymmetric signature algorithms such ...
5
votes
1answer
142 views

Discovering private exponent from public key

I'm going to assume this isn't possible, but I have to ask because I'm trying to fundamentally understand what I've thus far been trying to implement by following an RFC. SRP-6a starts off with ...
5
votes
1answer
2k views

Get RSA PlainText without Knowing Private Key

If I have an algorithm,RSA-Crack(), that, for a given RSA public key (n,e), is able to decrypt 1% of the messages encrypted with that key (without knowledge of the corresponding private key).Can there ...
5
votes
1answer
14k views

Calculating private keys in the RSA cryptosystem

The number $43733$ was chosen as base for an implementation of the RSA system. $M=19985$ is the message, that was encrypted with help of a public key $K=53$. What is the plaintext text? What is the ...
5
votes
1answer
335 views

How are trapdoor functions developed/found and where can I find existing ones?

Trapdoor functions are a fundamental part of public key cryptography. An example of the most common trapdoor is Prime Factorization, used in cryptosystems such as RSA How are these trapdoor ...
5
votes
3answers
3k views

Using ECDSA keys for encryption

I know that ECDSA is used for signature only, but I wonder if I can use the public/private Elliptic Curve keys for encryption too. I have ECDSA SSH public keys and I wonder if I can use them to ...
5
votes
1answer
320 views

How can I take advantage of repeated patterns in non random RSA prime factors?

I am researching vulnerable RSA moduli which are composed of primes generated with poor entropy. Having a list of these primes I searched for variable sized repeated patterns among them and I noticed ...
5
votes
1answer
651 views

Families of public/private keys in elliptic curve cryptography

I'm looking for a related key scheme for elliptic curve cryptography. The basic idea would be that there would be a master public key and a master private key. From the master public key, you could ...
5
votes
1answer
134 views

Encryption scheme like RSA where encryption is the inverse of decryption

In RSA, it is basically equivalent to use the private key $d$ to encrypt as it is to use the public key $e$ to encrypt. They are exactly inverses: $e=d^{-1}$. I need to know, are there other public ...
5
votes
1answer
2k views

Is this design of client side encryption secure?

I want to build a secure file storage web application. Users should be sure that server doesn't know how to decrypt files so encryption should take place at client side (i.e. in Javascript) and TLS ...
5
votes
3answers
852 views

How can I prevent a message replay with RSA?

I am using RSA to encrypt some data but I would like to eliminate the possibility of message replay. By message replay I mean sending a valid message multiple times to the original recipient. It is ...
5
votes
1answer
217 views

Why $e>n^{3/2}$ prevents Wiener's attack

Here's the Wiener's attack as I understand it. Suppose $n=pq$ with $q < p < 2q$, and $d < n^{1/4}/3$ where $ed=k\phi(n)+1$ and $e < \phi(n)$. $$\begin{align*} n-\phi(n) ...
5
votes
1answer
256 views

Using same modulus for RSA

I know that there exist some attack when using same modulus. Can two different pairs of RSA key have the same modulus? RSA cracking: The same message is sent to two different people problem But ...
5
votes
1answer
176 views

Finding the subgroup in isogeny-based cryptography

Isogeny-based cryptography is one of the newest post-quantum cryptography. Hardness of this system is based on finding isogeny between two elliptic curves. Also this is theorem: Elliptic curves ...
5
votes
0answers
246 views

Given a 'good' basis for a lattice, how can we solve the CVP?

I'm doing a little bit of reading about lattices. I read that if we can find a 'short' basis for our given lattice, we can solve CVP and SVP very efficiently. However, the paper didn't describe an ...
4
votes
3answers
622 views

RSA primes vs. largest known primes

In the context of a new largest (mersenne) prime number being found this week - The largest known prime number is now 2^57,885,161 − 1, and it took 5 years to find ...
4
votes
2answers
335 views

Can we say that if $P=NP$ there is no CPA secure public key encryption?

I've learned that public key encryption is based on the problem of Discrete Log (as regard to group theory) which believed to be hard. But, can we say that it doesn't matter on which problem our ...