an asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption.
0
votes
1answer
66 views
Physical Level Encryption
What types of algorithms that are capable of signing a message are out there that run on a physical level, e.g. lacking the infrastructure of a standard PC, no memory, processor or motherboard in the ...
2
votes
1answer
63 views
How does OAEP improve the security of RSA?
The heart of OAEP algorithm used for RSA encryption are the cryptographic hash functions $H$ and $G$.
Does everybody (so also an adversary) know these functions?
If YES: How does it help the ...
1
vote
2answers
84 views
Why is the following RSA PRNG cryptographically secure?
One requirement states that the generator has to withstand the next-bit test.
Consider the following PRNG, where we calculate next output $x_i$ via the formula
$x_i = x_{i-1}^ e\mod n$.
I can see ...
6
votes
2answers
150 views
RSA leak bits to factor N
Suppose you randomly generate large primes p and q as in RSA, and then tell me N=pq but not p or q.
Then, you would like to actually let me factor N, except you should tell me as few bits of ...
-1
votes
1answer
82 views
What length should the padding be when encrypting or signing with RSA?
Does it matter what length the padding is? If so - what length should it be?
(Another point: Should it be random?)
0
votes
1answer
45 views
chaining rsa with ecies
In an answer to a previous question it was suggested that one way to protect your asymmetrically encrypted AES-256 keys, from say a solution to prime factorization, would be to chain asymmetric ...
5
votes
1answer
102 views
Proof that padded RSA is CPA-secure
I'm referring to page 383 of J. Katz and Y. Lindell's Introduction to Modern Cryptography. The book presents a padded RSA:
${\bf Key Generation:}$ same as Textbook RSA (given security parameter ...
0
votes
1answer
48 views
Certificate == signed public key
For primes p and q used to create a keypair, I understand that the following operation is used to create a signature :-
M ^ d (mod N)
where d and N have their usual meanings and M is the message. In ...
0
votes
2answers
85 views
risk of attacker decrypting RSA ciphertext without public or private key
As I describe in my previous question I am trying to decide if it's worth it for me to use the Offline Private Key Protocol in creating some long term private archives, instead of just going with a ...
0
votes
1answer
90 views
RSA - Ecrypting the same data with the same public key = same ciphertext?
If an adversary knows my public key and guesses what was my plaintext, can he test for it somehow?
The most obvious way is encrypting the guessed plaintext with my public key and the same parameters ...
3
votes
1answer
136 views
Secure encrypt-then-sign with RSA
I understand that when you want to encrypt and sign data with RSA the generally recommended approach is sign-then-encrypt.
However, I have encrypted data that I need to sign, to prove the author of ...
3
votes
1answer
81 views
implementing long term archive encryption
Let's say I want to create private archives for the long term (e.g. more than 30 ). The archives' sizes could be anywhere from 1 GB to 30 GB. As far as I understand I could go down two ways:
The ...
-4
votes
0answers
62 views
RSA Encryption Sckeme [closed]
Can anyone help me with this question?
A and B want to exchange encrypted messages; specifically, B wants to send a message M
written in binary format to A, which needs to be encrypted. They agree on ...
3
votes
1answer
109 views
Combining AEAD with RSA
'Hybrid' encryption, where we combine symmetric encryption with public-key cryptography, is pretty 'tried and tested'.
To summarise, we generate a symmetric key and encrypt it using RSA. We would ...
2
votes
4answers
190 views
Tamper-proofing log files
Problem Overview
I want to securely store log files so the contents are secret, and they can't be modified without detection.
The files will be encrypted using authenticated encryption (AES in GCM ...
4
votes
0answers
139 views
Prove that textbook RSA is susceptible to a chosen ciphertext attack
Given a ciphertext $y$, describe how to choose a ciphertext $\hat{y} \neq y$, such that knowledge of the plaintext $\hat{x}=d_K(\hat{y})$ allows $x=d_k(y)$ to be computed.
So I use the fact that the ...
2
votes
2answers
127 views
Chain several RSA encryptions without increasing the message size
I would like to be able to encrypt the output of RSA with RSA again without having the output grow in size over time.
In other words, I have some data $D_0$ which I want to encrypt with RSA: $D_1 = ...
1
vote
1answer
65 views
How to learn the first bit of m in padded RSA
Consider the following version of padded RSA encryption, where encryption of $m$ is done by setting $m′ = (0^k~||~r~||~00000000~||~m)$ for a random $r$ (of length 8 btyes = 64 bits) and then computing ...
5
votes
1answer
116 views
In textbook RSA with low public exponent, how big does a random message needs to be?
Assume RSA with a public modulus $N$ of $n$ bits, a small odd public exponent $e$, plaintext $M$ a random non-negative integer less than $2^m$ for some integer parameter $m$, with $M\mapsto C=M^e\bmod ...
1
vote
1answer
51 views
Comprehension question on a signature protocol based on the RSA assumption
We have the following two-party protocol between Alice and Bob. Alice sends messages $m_1, m_2, \ldots \in_R \mathbb{Z}_n^*$ to Bob and Bob signs these values by calculating $v_1, v_2, \ldots \in_R ...
0
votes
1answer
47 views
EC equivalent for RSA-OAEP
I have some questions regarding aforementioned subject:
Is there a EC equivalent of RSA-OAEP key transport/encryption algorithm ?
Is ECIES-KEM sufficient ?
2
votes
2answers
132 views
How can mega store my login details and still be secure?
I understand how Mega's encryption works. For a quick summary of all those in the future looking for an answer on this... here is how it works:
Upon first signing up for an account you make a ...
1
vote
2answers
84 views
It is reasonably safe to leave a SSH private key with a 30+ character passphrase public?
I'm curious about exploring uses for a distributing a single RSA private key with a passphrase instead of trying to secure the private key and distribute the public key. With the private key (and ...
2
votes
2answers
150 views
Why are RSA key sizes almost always a power of two?
I know that other bit sizes are possible, e.g. this HTTPS server seems to have a 9000 bit key https://www.ssllabs.com/ssltest/analyze.html?d=qqq.gg, but it's very rare that one sees a key not of size ...
0
votes
1answer
46 views
Solving congruences using PARI
I'm having trouble finding info in the docs about how to solve a system of congruences. The closest I can find is 'matsolvemod' in here: ...
2
votes
1answer
180 views
Low Public Exponent Attack for RSA
I'm having trouble understanding the algorithm for finding the original message $m$, when there is a small public exponent. Here is the example I'm trying to follow (you can also read it in the 'Low ...
0
votes
0answers
57 views
Method and explanation for calculating difference in speed between DES and RSA
Our assignment asks us to convert an RSA speed in bytes per second to a DES speed in bytes per second. Our professor's treatment of this ("RSA is 100 times slower than DES") seems insufficient. Could ...
1
vote
1answer
84 views
Is this method for exchanging private key using RSA sound?
Bob know's Alice's public key, and he wants to make sure he's connecting to the one which has that key. Furthermore, Alice wants to verify when she gets a connection from Bob who'll give his public ...
0
votes
0answers
36 views
Is it possible to determine the group order by knowing the “public” and “private” key exponents in an RSA group?
I have an RSA group with modulus $n = p \cdot q$, two safe primes $p=2p'+1$ and $q=2q'+1$ and the "public" and "private" key exponents $d$ and $e$. $\phi(n) = 4p'q'$ is the order of the RSA group. If ...
7
votes
0answers
131 views
What changed in PKCS#1 v2.2, and why?
PKCS#1 is one of the most used (de-facto) standard for real-world use of RSA.
That's for good reasons: PKCS#1 is well thought, versatile, understandable, has been relatively stable for over two ...
2
votes
1answer
246 views
Is a known plaintext, ciphertext, and public-key a viable attack on RSA?
Assume Alice and Bob are using RSA to create a common session key and Cindy is listening, attempting to obtain the session key.
Alice and Bob each have their public- and private-key pairs ...
1
vote
2answers
185 views
What data is saved in RSA private key?
What data is saved in RSA private key in openssl? How to view it?
Wikpedia says these variables are saved.
0
votes
1answer
127 views
Possibility of factorisation of rsa modulus due to vulnerability in java implementation code
Below is my implementation of the RSA algorithm. Actually I'm choosing the private key (d) instead of public key (e) and computing the public key.It is working fine but
I want to know if this is a ...
4
votes
1answer
85 views
In RSA, how to make sure that $p-1$ and $q-1$ are still hard to factorize?
See this question. The comment by Brett Hale stated:
On the other hand, ensuring $(p - 1)$ has a large prime factor requires very little extra effort.
What's actually the 'little extra effort'?
2
votes
1answer
101 views
Are RSA signatures deterministic?
If I sign the word HELLO with the mechanism "NONEwithRSA" with the same private key, do I always will have the same signature?
A Java example always return ...
4
votes
1answer
135 views
Question about why RSA is hard to attack
I think I understand why RSA is hard to attack but I'd like to get clarification if I actually do.
Assume there are two people, Alice and Bob, who are attempting to communicate privately but that we ...
0
votes
0answers
71 views
Strong RSA problem in $\mathbb Z^*_{n^2}$
Comparing to this question, assume $C, M \in \mathbb Z^*_{n^2}$, $e \ge 3$, is it hard to compute $M$ that satisfies $C=M^e \mod n^2$ when $C$ and $(n, e)$ are given?
0
votes
1answer
94 views
Why are RSA keys encoded with ASN.1 for TLS?
Browser vendors use ASN.1 encoding for RSA certificates in the TLS protocol. RSA public keys are just a number, so why do we need encode them to something else? That increases the risk of security ...
0
votes
1answer
42 views
RSA Certificate Owner and Issuer line meanings?
Apologies if this question is not in the right place.
I've recently been looking through some RSA certificates ( specifically, Android apk .rsa files) and I'm having trouble deciphering the one and ...
1
vote
2answers
163 views
Why is RSA encryption significantly faster than decryption?
I am designing an implementation of RSA . I recorded computation times in Java by using System.currentTimeMillis(). It returned an encryption time of 0.05 ms and ...
-1
votes
1answer
64 views
RSA SHA1 signature from public key
Is it possible to generate signature only from Public key. See example below where i have valid signature but what if I change hash ? Is then any way to do this?
Public key(160 bytes):
...
1
vote
1answer
53 views
Is sharing the modulus for multiple RSA key pairs secure?
In the public-key system RSA scheme, each user holds beyond a public modulus $m$ a public exponent, $e$, and a private exponent, $d$.
Suppose that Bob gives his private exponent to other users. ...
2
votes
1answer
173 views
Extract private RSA key from USB cryptographic token using Bardou et al. attack (varian of “million message attack”)
There is a side channel attack on tamper-resistant USB cryptographic tokens using padding-oracle, described by Bardou, Focardi, Kawamoto, Simionato, Steel and Tsay, titled "Efficient padding oracle ...
1
vote
2answers
100 views
Is semantic security important in a hybrid cryptosystem?
RSA doesn't provide semantic security when used unmodified, and neither does the commonly used PKCS#1 v.1.5 padding scheme for encryption.
Is this a problem for hybrid cryptosystems at all?
My ...
0
votes
2answers
63 views
What is RSA key normalization?
How can I understand the term RSA key normalization? What exactly is done in the process??
Please explain.
1
vote
1answer
399 views
How do I derive the time complexity of encryption and decryption based on modular arithmetic?
I want to calculate the time complexity of two encryption and decryption algorithms.
The first one (RSA-like) has the encryption
$$ C := M^e \bmod N $$
and decryption
$$ M_P := C^d \bmod N. $$
...
0
votes
0answers
81 views
RSA and One Time Password (OTP) service
What is the expert cryptographic opinion on the following?
Assume that there is a web server and a client on web page.
User on the Client calls an OTP web service on the server which
a) creates a ...
0
votes
0answers
47 views
How compute encrypt and decrypt runtime for agorithm [closed]
I programming RSA algorithm is the following two function in java language in my thesis
...
3
votes
1answer
119 views
How to find an element of high-order in an RSA group?
Is this even possible? The RSA group is not cyclic, so usually you wouldn't find a generator for accessing all group elements.
What happens if you use the RSA group in a scenario where you want that ...
1
vote
1answer
57 views
What is the most secure way to let Alice “input” her private key, transfer it to the server and decrypt the message?
What is the most secure way to let Alice "input" her private key, transfer it to the server and decrypt the message? (Then destroy the private key on the server)
Every connection is using SSL.
...
