an asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption.

learn more… | top users | synonyms

1
vote
0answers
21 views

where is ANS X9.31 used?

FIPS 186-4 mentions two standards for RSA: PKCS #1 and ANS X9.31. PKCS #1 is used with SSH, X.509, etc. What is ANS X9.31 used with? FIPS 186-4 has the following line: ANS X9.31, Digital ...
6
votes
2answers
149 views

RSA: revealing the modulus factorization by choosing a bad message

I started reading the book Cryptanalysis of RSA and its variants by M. Jason Hinek and I stumbled upon a phrase that intrigued me: plaintext messages that are relatively prime to the modulus (i....
6
votes
2answers
984 views

Do I really need to use the same private/public key pair in RSA?

So I'm making an Android application, I need my application to be only able to scan my own generated QR codes, and I want to make sure that nobody else can generate fake ones. The data isn't ...
6
votes
1answer
587 views

Is unusual (non power-of-two) RSA key size more secure?

On this blog https://blog.josefsson.org/2014/06/23/offline-gnupg-master-key-and-subkeys-on-yubikey-neo-smartcard/ there is a following sentence Generate master key Below I will use a 3744 bit ...
0
votes
0answers
277 views

Changing plaintext for encryption in RSA [duplicate]

In the RSA crypto scheme, the message $x$ (plaintext), is encrypted to produce ciphertext ($y$), by computing $x^e \bmod n$. Of course, that means that $x$ has to be a numeric value for this to work, ...
-3
votes
2answers
61 views

Why are asymmetric keys represented as base 64? [closed]

When one generates a public and private key with say a total of 4096 bits, why does the program output what I assume to be base 64 instead of base 10 or binary?
0
votes
2answers
61 views

Is this RSA signing and verification process secure?

I need to verify that messages in a communications program are from valid senders. Below is a highlevel outline of how I think the process would work. The connections themselves are done over TLS. The ...
6
votes
1answer
129 views

Is solving $m^3 = k*n + c$ hard?

Given the equation $$m^3 = k\cdot n + c$$ I know $n$ and $c$, and I need to find $k$, so that $m$ is a natural number. $n$ and $c$ are large numbers, so i can't use bruteforce. How can you find a ...
1
vote
1answer
18 views

Extra attributes in a certificate signing request

When creating a certificate signing request, there is a part where openssl says "Please enter the following extra attributes to be sent with your certificate request". One of these is a challenge ...
-1
votes
1answer
80 views

Can I calculate $d$ given only RSA’s $c$, $n$ and $e$?

The question “Calculating RSA private exponent when given public exponent and the modulus factors using extended euclid” assumes the factors are known. This got me wondering if it is possible to ...
2
votes
1answer
23 views

Can MGF1 within OAEP and PSS be replaced by a XOF?

Do we still need MGF1 as used in the PKCS#1 v2.x specifications for SHA-3 hash functions? MGF1 is currently used for OAEP and PSS as Mask Generation Function. Now that the SHA-3 specification contains ...
3
votes
1answer
387 views

When would I need DSA as opposed to RSA for digital signature?

The digital signature algorithm encrypts a hash using the senders private key and the receiver's public key. This multiple encryption is a pretty expensive process since public key encryption is so ...
5
votes
1answer
33 views

In PKCS#1 V2.2, should MGF be based on the same hash function that RSA-OAEP-ENCRYPT uses?

In Section 7.1.1 of PKCS#1 v2.2 there are two options for RSAES-OAEP-Encrypt given: Hash MGF Appendix B.2.1 of the same document states that MGF1 is based on a hash function. Is MGF1 based on the ...
1
vote
1answer
42 views

Clarification on Key exchange approaches in TLS/SSL

When RSA is used for key exchange in SSL, the client basically encrypts some random data using the server's public key and and sends it to the server. This data is then used to compute the shared key ...
7
votes
6answers
2k views

Why MACs are so important despite digital signatures doing everything a MAC can do and more

When an entity A wants to send a message to entity B, he can attach a MAC to the message. Entity B on receiving the message can use the pre-shared key to compute the same MAC and confirm if the ...
-1
votes
1answer
78 views

Calculating $d$ in RSA?

I've looked in many places including here and can't get quite the answer... So I thought I'd post a question. I can't grasp how $d$ is calculated. Obviously the problem is that knowing $e$ and $n$ ...
1
vote
1answer
60 views

RSA key generation gives d=1

I was reviewing RSA by hand. I picked 53 and 59 as my primes. For e I picked 5. When I solved for d using extended euclid, I got 1 which obviously doesn't decrypt anything. I checked my answers online ...
-3
votes
0answers
33 views

What does the encyption part of RSA entail?

As part of an assignment I have to encrypt and decrypt the following two block message (115, 209), using two primes (p = 17, q = 13). e = 5. I computed n to be 221 (17 * 13) and I confirmed that e ...
2
votes
1answer
32 views

What are I2OSP & OS2IP in RSA-PSS verification?

I started working with RSA two weeks ago. But I coudn't really understand how exactly I2OSP & OS2IP are working. I am using some open source for signature verification through RSA PSS algo. I am ...
4
votes
1answer
45 views

What are the differences between X9.31 RSA operation and PKCS#1 RSA operation?

NIST and other - mainly older - standards often don't just mention PKCS#1 RSA algorithms but also X9.31 RSA algorithms. What are the differences between X9.31 and PKCS#1 (v2.1) with regards to key ...
6
votes
1answer
87 views

What does Shor's algorithm tell us about the complexity class of RSA and the DLP?

If quantum computers operate in BQP and (using Shor's algorithm) they are able to factor large integers and break the discrete log problem, what does that tell us about the complexity class of these ...
-1
votes
3answers
113 views

Why is RSA decryption the inverse of encryption?

In RSA, to encrypt a message, the following formula is used: $$c=m^e\bmod n$$ For decryption, $$m = c^d\bmod n$$ is used. However, when I try to substitute the value of $c$ from the first into the ...
1
vote
2answers
237 views

RSA cipher: ambiguous or break by eth root?

Confused about RSA message cipher: $c = m^e (mod\ n)$ So if $m^e$ can be greater than n, then you can get duplicate ciphers for the same message. Most postings I've read say that $m^e$ must always ...
-2
votes
0answers
73 views

How to calculate ϕ(n) from n?

I'm trying to fully understand all the steps of the RSA algorithm. I have clear so far that: $n$ comes from the product of two numbers: $p$ and $q$ The public key consists of the pair ($e$, $n$) ...
3
votes
1answer
99 views

Do equivalent RSA keys exist?

If $m^{ed} \bmod n = m$ for message $m$, public key $e$ and private key $d$, then adding any integer multiple of $n$ to $m^{ed}$ still equals $m$ modulo $n$. Supposing it exists, how do I find an ...
0
votes
0answers
19 views

How to prove a key generation protocol based on blind RSA signature?

It seems like that a user may use blind RSA signature to obviously generate a key. My design is as follows. Please correct me if I get anything wrong. (Please refer to WiKi https://en.wikipedia.org/...
1
vote
1answer
27 views

AEAD: Is it secure to decrypt the content encryption key before verifying the MAC?

The JSON Web Encryption (JWE) standard defines a number of encryption modes with the same basic form: First, the a unique content encryption key (CEK) is generated and used to encrypt the payload ...
3
votes
0answers
37 views

Computing cost for a trillionaire to compute GNFS in RFC 3766

RFC 3766, Section 4.1 discusses picking $n$ to achieve some target cost for employing the GNFS, i.e., $T$ is known and $N$ is unknown in the below equation: $$T = \kappa \cdot \exp{\left(c \cdot (\ln{...
1
vote
1answer
145 views

justification for method to factorize n knowing RSA private exponent d

I know that knowing the private exponent $d$ corresponding to the private key $k_{pub}\langle n,e\rangle$ it is possible to efficiently factorize n. The procedure starts stating that: $ed -1 = s(p-1)...
1
vote
0answers
71 views

Feasible attacks on ECRSA cryptosystem

In ECRSA cryptosystem, I want to know the feasible attacks. For illustrations we have two prime $p$ and $q$ such that $p \equiv 2 \pmod 3$, $q \equiv 2 \pmod 3$ and generate key pair as follows: $$n = ...
0
votes
1answer
37 views

Do RSA keys contain a checksum mechanism? [duplicate]

I'm new to cryptography, and I was making an experiment a few minutes ago, but I want to have some deeper knowledge about RSA public and private keys. I have a set of keys One begins with ...
0
votes
0answers
55 views

Why is RSA still being used? [duplicate]

In hybrid encrytion, I still see that some site's use RSA in their https connection, so now I wonder, why do they not use ECC instead of RSA, ECC requires less computational power and encrypt's and ...
2
votes
1answer
136 views

How does DH work when combined with ECC or RSA?

I know that Diffie-Hellman is used to create keys in a secure way over an insecure channel. But there is one thing which I cannot understand: I see that a lot of sites use ECC or RSA alongside DH. ...
0
votes
1answer
65 views

Questions about length key of RSA 2048 bit

I use putty gen to generate RSA key, I choose length of key is 2048 bit, it generate public key: ...
2
votes
1answer
121 views

Forgery attack against Textbook RSA with simple redundancy

I know how to forge vanilla Textbook RSA message signatures (easy). I've learnt that by adding a good redundancy to the message, it cannot be forged anymore. How can one add redundancy so that the ...
0
votes
0answers
24 views

Diffie-Hellman combined with DSA/RSA

we have learned Diffie-Hellman, RSA and DSA (Digital Signature Algorithm) in university. Because DH is vulnerable of Man-in-the-Middle we had the task to program the DH combined with RSA to protect ...
0
votes
1answer
33 views

factorization of an integer $N$ that is in special format

Suppose $p_0$ and $q_0$ are known prime numbers and define $p_i$ and $q_i$ as follows: $$p_{i+1} = next\_prime(p_i^2 + q_i^2), \qquad i \ge 0$$ and $$q_{i+1} = next\_prime(2p_iq_i), \qquad i \ge 0$$ ...
1
vote
0answers
33 views

Are public key and private key exchangeable? [duplicate]

If I get a key pair from RSA algorithm, can I make Private-Key public, and keep Public-Key secret without breaking the security of encryption and signature?
6
votes
0answers
58 views

Name of an archaic type of RSA padding (0BBBBBBB…)

In some legacy code, I encountered RSA signature padding in the following format (hexadecimal): 0B BB BB BB BB BB BB ... BB BB <hash> Is there a name for ...
1
vote
0answers
51 views

How can I obtain the raw decimal value of an RSA key's modulus?

So maybe I'm thinking about this too hard, or maybe I'm missing a piece of information. We'll use Google for this example. Say I wanted to obtain the modulus of Google's current public key. Well I ...
2
votes
1answer
62 views

How to prove a lemma that is based on phi-hiding assumption?

Assume that the $\phi$-hiding assumption is true, i.e. that for a composite number $m$, a PPT adversary A cannot distinguish between a prime $p_0$ that divides $\phi(m)$ and another prime $p_1$ that ...
0
votes
0answers
46 views

How to encrypt huge data using RSA? [duplicate]

Is there any way to encrypt the huge amount of data using RSA? I was supposed it is possible but when I read some articles what I saw is that, this is bad practice or they say can only encrypt bit ...
7
votes
2answers
386 views

Can Shor's algorithm compromise RSA when both the public and private key are secret?

If RSA is to create a public private key pair and encryption is performed on plain test P to create cipher text C, given P and C could Shor's algorithm be used to find either of the public and private ...
0
votes
0answers
74 views

RSA PlainText without Knowing Private Key

I couldn't solve this problem for three days... In RSA, [n = 13, 19] [e = 3] c1 = m^3 = 83 mod 247 [e=5] c2 = m^5 = 97 mod 247 then, use ...
3
votes
1answer
38 views

Is there a way to turn a PGP key into its semi-prime counterpart?

From my understanding of PGP keys they use the RSA algorithms to encrypt/decrypt messages. So, I know that the RSA algorithms use a semi-prime number to encrypt/decrypt messages. So, what I was ...
3
votes
1answer
92 views

RSA Digital Signature vs Elgamal Digital Signature

What are the advantages of RSA signatures against ElGamal signatures? Is there a situation in which it would be better e.g. to use RSA signatures?
4
votes
1answer
129 views

Why does choosing the first coprime e greater than half of φ(n) result in the same d (private exponent)

While reading on RSA's algorithm, I attempted a simplified implementation and noticed the following: When choosing the public exponent $e$, if the value chosen is the first coprime after $φ(n)/2$ ...
3
votes
1answer
79 views

Highest prime factor that is Safe for a particular scheme

My question is how many bits of prime number is secure so that it cannot be factored from very large number? Until today how large prime factor is found in large number? Quantum computing find ...
0
votes
2answers
74 views

Factoring an RSA modulus given high bits of a factor

I have {e,N,C} and part of p; can I get q from this example : ...
3
votes
1answer
36 views

How does this solution guarantee authentication of B and privacy?

The exercise is: What could be changed on the second message " Kya(Kxb(Ra,Ks)) " to guarantee B's authenthicity and also privacy? My teacher's solution was "add a destination" , so it would be ...