an asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption.
2
votes
0answers
28 views
low-exponent RSA
I have questions from http://link.springer.com/chapter/10.1007%2F3-540-68339-9_1
Suppose we have 2 messages $m_1$ and $m_2$ related by a known relation $m_2=m_1+1$.
Suppose further the messages are ...
0
votes
0answers
59 views
Why is it impractical to generate a semiprime dictionary? [duplicate]
This might be a very simple question. However, I am just learning the concept, so just excuse me.
I am wondering why there is not any attempt to generate all semiprime numbers? (as an dict. attack to ...
2
votes
1answer
83 views
Given a private RSA key, how do we get the public key?
Is it possible to pre-choose a private RSA key, then obtain a public key from it?
-1
votes
1answer
47 views
How to choose the appropriate public (i, m) and private (j, m) keys?
I studied some encryption and decryption and I have found some very interesting problem to solve on the internet. I hope I am writing to right site - there are so many in StackExchange otherwise I ...
0
votes
1answer
80 views
Preimage resistance hash in digital signature
I'm studying about preimage resistance property of the hash functions.
In particularly I'm reading as the missing of this property can be fatal in digital signatures that use RSA.
Further details:
...
4
votes
1answer
111 views
Security strength of RSA in relation with the modulus size
NIST SP 800-57 §5.6.1 p.62–64 specifies a correspondence between RSA modulus size $n$ and expected security strength $s$ in bits:
...
3
votes
3answers
60 views
What are some good references for the implementation weaknesses in RSA
I'm pretty sure I understand textbook RSA.
Choose p and q, large primes, and compute n=pq.
Choose e such that $gcd(\phi(n),e)=1.$
Publish n and e.
Compute d such that $de=1$ (mod $\phi(n)$).
To ...
2
votes
1answer
81 views
Can you identify the public key used to encrypt something?
If I encrypt a string with a public key, does the encrypted ciphertext reveal the public key I used to encrypt it? Basically, I don't want anyone to know who the ciphertext is addressed to.
I'm ...
0
votes
1answer
82 views
How long to bruteforce a RSA key
Suppose I have a 2048 bit RSA public key, and want to brute force the corresponding private key. I guess there are 2048^16 possible combinations?
How long would this take me to brute force with an ...
0
votes
3answers
102 views
Amateur question: two-way RSA?
Is this a sensible scheme for 2-way client/server communication? A client connects to a server. The server and client both generate RSA keys, and send over the public ones to each other. If the client ...
1
vote
1answer
76 views
What kind of cryptography should i use?
I have a trusted third part A that issues an access token (xml file) to an untrusted client C that uses this token to log into an untrusted server S and access to the authorized files.
I want only ...
-2
votes
2answers
87 views
Is triple des similiar to RSA in that they message size is limited to the key size?
Is triple des similiar to rsa in that the message size you can encrypt is limited (unlike AES)?
Yes you can break the message size into parts and apply it, but I'm not interested in doing that so I ...
1
vote
1answer
40 views
When making public key fingerprints - is a sha1 hash still a good idea?
I'm thinking about trying to save some space (and readability) when referencing 2k and 4k public keys (millions of them) by storing the fingerprint in some places instead of the full public key.
...
1
vote
1answer
53 views
How is text converted to a number for RSA?
According to http://en.wikipedia.org/wiki/RSA_%28algorithm%29#Key_generation the key length is the number of bits in n. So how can a message of many megabytes (millions of bits) be modded by a 1024 ...
2
votes
3answers
167 views
If RSA is limited to 117-200 bytes or so, is that a very limited use case?
Am I missing something, or is RSA very very limiting when it comes to ecrypting data when it comes to the actual message size?
I have read that you can only encrypt a message of around 117 to 200 ...
4
votes
1answer
158 views
What do recent announcements about solving the DLP in $GF(2^{6120})$ mean for RSA
After just reading the post Do recent announcements about solving the DLP in $GF(2^{6120})$ apply to schemes proposed for cryptographic use?
I was a bit confused. DSA, ElGamal and others are based on ...
0
votes
0answers
49 views
RSA vs El Gamal digital signature. Which is more secure?
I'm reading about the notions of security concerning digital signatures and I can't understand whether RSA is more secure than El Gamal digital signature. Well, they are both prone to forgery, but I ...
2
votes
1answer
106 views
Why is verification using DSA slower than verification with RSA?
We read in literature that verification of a digital signature is slower using DSA than if we used RSA. Why is this?
DSA parameter generation:
choose prime number $p$
choose prime number $q$ such ...
2
votes
2answers
209 views
Why RSA uses {d,n} as private key instead of {e,n}?
While studying the RSA algorithm I referred to some books and some sites such as RSA (wikipedia) and all of them chose {d,n} as the secret (private) key and release {e,n} as the public key but as d ...
13
votes
1answer
295 views
What security authorities and standards reject $e=3$ in RSA, when, and with what rationale?
In RSA, some security authorities and/or standards allow the public exponent $e=3$, others require or recommend $e>2^{16}$ (or perhaps some other minimum). I gathered the following:
PKCS#1 allows ...
-3
votes
0answers
75 views
RSA decryption from ciphertext using private key [closed]
I am sniffing a client side application traffic and I found some encrypted data. I am not able to decrypt it. Information which I have is
Public Key:
...
0
votes
2answers
132 views
Physical Level Encryption
What types of algorithms that are capable of signing a message are out there that run on a physical level, e.g. lacking the infrastructure of a standard PC, no memory, processor or motherboard in the ...
2
votes
1answer
108 views
How does OAEP improve the security of RSA?
The heart of OAEP algorithm used for RSA encryption are the cryptographic hash functions $H$ and $G$.
Does everybody (so also an adversary) know these functions?
If YES: How does it help the ...
1
vote
2answers
96 views
Why is the following RSA PRNG cryptographically secure?
One requirement states that the generator has to withstand the next-bit test.
Consider the following PRNG, where we calculate next output $x_i$ via the formula
$x_i = x_{i-1}^ e\mod n$.
I can see ...
6
votes
2answers
183 views
RSA leak bits to factor N
Suppose you randomly generate large primes p and q as in RSA, and then tell me N=pq but not p or q.
Then, you would like to actually let me factor N, except you should tell me as few bits of ...
-1
votes
1answer
91 views
What length should the padding be when encrypting or signing with RSA?
Does it matter what length the padding is? If so - what length should it be?
(Another point: Should it be random?)
0
votes
1answer
51 views
chaining rsa with ecies
In an answer to a previous question it was suggested that one way to protect your asymmetrically encrypted AES-256 keys, from say a solution to prime factorization, would be to chain asymmetric ...
5
votes
1answer
116 views
Proof that padded RSA is CPA-secure
I'm referring to page 383 of J. Katz and Y. Lindell's Introduction to Modern Cryptography. The book presents a padded RSA:
${\bf Key Generation:}$ same as Textbook RSA (given security parameter ...
0
votes
1answer
50 views
Certificate == signed public key
For primes p and q used to create a keypair, I understand that the following operation is used to create a signature :-
M ^ d (mod N)
where d and N have their usual meanings and M is the message. In ...
1
vote
2answers
122 views
risk of attacker decrypting RSA ciphertext without public or private key
As I describe in my previous question I am trying to decide if it's worth it for me to use the Offline Private Key Protocol in creating some long term private archives, instead of just going with a ...
0
votes
1answer
99 views
RSA - Ecrypting the same data with the same public key = same ciphertext?
If an adversary knows my public key and guesses what was my plaintext, can he test for it somehow?
The most obvious way is encrypting the guessed plaintext with my public key and the same parameters ...
3
votes
1answer
166 views
Secure encrypt-then-sign with RSA
I understand that when you want to encrypt and sign data with RSA the generally recommended approach is sign-then-encrypt.
However, I have encrypted data that I need to sign, to prove the author of ...
3
votes
1answer
85 views
implementing long term archive encryption
Let's say I want to create private archives for the long term (e.g. more than 30 ). The archives' sizes could be anywhere from 1 GB to 30 GB. As far as I understand I could go down two ways:
The ...
3
votes
1answer
120 views
Combining AEAD with RSA
'Hybrid' encryption, where we combine symmetric encryption with public-key cryptography, is pretty 'tried and tested'.
To summarise, we generate a symmetric key and encrypt it using RSA. We would ...
2
votes
4answers
203 views
Tamper-proofing log files
Problem Overview
I want to securely store log files so the contents are secret, and they can't be modified without detection.
The files will be encrypted using authenticated encryption (AES in GCM ...
5
votes
0answers
155 views
Prove that textbook RSA is susceptible to a chosen ciphertext attack
Given a ciphertext $y$, describe how to choose a ciphertext $\hat{y} \neq y$, such that knowledge of the plaintext $\hat{x}=d_K(\hat{y})$ allows $x=d_k(y)$ to be computed.
So I use the fact that the ...
2
votes
2answers
131 views
Chain several RSA encryptions without increasing the message size
I would like to be able to encrypt the output of RSA with RSA again without having the output grow in size over time.
In other words, I have some data $D_0$ which I want to encrypt with RSA: $D_1 = ...
1
vote
1answer
67 views
How to learn the first bit of m in padded RSA
Consider the following version of padded RSA encryption, where encryption of $m$ is done by setting $m′ = (0^k~||~r~||~00000000~||~m)$ for a random $r$ (of length 8 btyes = 64 bits) and then computing ...
5
votes
1answer
130 views
In textbook RSA with low public exponent, how big does a random message needs to be?
Assume RSA with a public modulus $N$ of $n$ bits, a small odd public exponent $e$, plaintext $M$ a random non-negative integer less than $2^m$ for some integer parameter $m$, with $M\mapsto C=M^e\bmod ...
1
vote
1answer
54 views
Comprehension question on a signature protocol based on the RSA assumption
We have the following two-party protocol between Alice and Bob. Alice sends messages $m_1, m_2, \ldots \in_R \mathbb{Z}_n^*$ to Bob and Bob signs these values by calculating $v_1, v_2, \ldots \in_R ...
0
votes
1answer
56 views
EC equivalent for RSA-OAEP
I have some questions regarding aforementioned subject:
Is there a EC equivalent of RSA-OAEP key transport/encryption algorithm ?
Is ECIES-KEM sufficient ?
2
votes
2answers
143 views
How can mega store my login details and still be secure?
I understand how Mega's encryption works. For a quick summary of all those in the future looking for an answer on this... here is how it works:
Upon first signing up for an account you make a ...
1
vote
2answers
104 views
It is reasonably safe to leave a SSH private key with a 30+ character passphrase public?
I'm curious about exploring uses for a distributing a single RSA private key with a passphrase instead of trying to secure the private key and distribute the public key. With the private key (and ...
2
votes
2answers
165 views
Why are RSA key sizes almost always a power of two?
I know that other bit sizes are possible, e.g. this HTTPS server seems to have a 9000 bit key https://www.ssllabs.com/ssltest/analyze.html?d=qqq.gg, but it's very rare that one sees a key not of size ...
2
votes
1answer
124 views
Cracking an RSA with no padding and very small e
I have a project wherein I have to crack a given cipher text encrypted using RSA and have been given N and e. Can someone suggest an RSA attack using a very small exponent e(here e=3) and no padding?
0
votes
1answer
50 views
Solving congruences using PARI
I'm having trouble finding info in the docs about how to solve a system of congruences. The closest I can find is 'matsolvemod' in here: ...
2
votes
1answer
221 views
Low Public Exponent Attack for RSA
I'm having trouble understanding the algorithm for finding the original message $m$, when there is a small public exponent. Here is the example I'm trying to follow (you can also read it in the 'Low ...
0
votes
0answers
67 views
Method and explanation for calculating difference in speed between DES and RSA
Our assignment asks us to convert an RSA speed in bytes per second to a DES speed in bytes per second. Our professor's treatment of this ("RSA is 100 times slower than DES") seems insufficient. Could ...
1
vote
1answer
105 views
Is this method for exchanging private key using RSA sound?
Bob know's Alice's public key, and he wants to make sure he's connecting to the one which has that key. Furthermore, Alice wants to verify when she gets a connection from Bob who'll give his public ...
0
votes
0answers
41 views
Is it possible to determine the group order by knowing the “public” and “private” key exponents in an RSA group?
I have an RSA group with modulus $n = p \cdot q$, two safe primes $p=2p'+1$ and $q=2q'+1$ and the "public" and "private" key exponents $d$ and $e$. $\phi(n) = 4p'q'$ is the order of the RSA group. If ...
