an asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption.

learn more… | top users | synonyms

2
votes
2answers
290 views

Encryption with private key?

we normally always encrypt by public key and decrypt with private key. If i encrypt with private key, then its still secure as normal PKI ? i mean known-plain-text will not take private key on the ...
3
votes
1answer
326 views

RSA algorithm's license free or paid?

I checked RSA's patent application, which was registered in 1983. As patents don't last more than 20 years, it seems to me it should be free. But my friend said to use RSA I have to buy a license from ...
4
votes
2answers
155 views

Does a high exponent compensate for a low degree of certainty?

If a RSA certificate is created with a low degree of certainty, does the value of the exponent compensate for this? I'm asking because certain implementations of key generation software hide the ...
8
votes
2answers
3k views

Impacts of not using RSA exponent of 65537

This RFC says the RSA Exponent should be 65537. Why is that number recommended and what are the theoretical and practical impacts & risks of making that number higher or lower? What are the ...
2
votes
2answers
935 views

How to decrypt this RSA-like cipher

Suppose we have a RSA-type Modulus $n = pq$ with $p,q$ prime. We also pick a random public exponent $e$ with $\gcd(e,\varphi(n)) = 1$ and compute the private exponent $d$ with $de \equiv 1 ...
1
vote
1answer
575 views

What is the correct value for “certainty” in RSA key pair generation?

I'm creating an RSA key pair in Bouncy Castle and need to specify an int value for certainty. This Stack Overflow answer says it is a relative test for how prime the values are. There is another ...
2
votes
2answers
168 views

Is there a way to compare the 923 bit pairing based key with RSA or AES, etc

I've see many articles, most of them basically the same, praising Fujitsu for cracking what is referred to as a 923 bit pairing based encryption. I understand that in comparing RSA to AES you've got ...
5
votes
2answers
4k views

How much computing resource is required to brute-force RSA?

It's been over 30 years since Rivest, Shamir and Adleman first publicly described their algorithm for public-key cryptography; and the intelligence community is thought to have known about it for ...
2
votes
2answers
472 views

How exactly are GPG keys mathematically related, and prime numbers inside of GPG general

Before anyone suggest it, I've yet to pick up "Applied Cryptography" I'm planning on picking it up the next time I visit amazon. I know that the keys are somehow mathematically related, and I know ...
2
votes
2answers
2k views

RSA Proof of Correctness

Can anyone provide an extended (and well explained) proof of correctness of the RSA Algorithm? And why is it needed? I can't say that this or this helped me much, I'd like a more detailed and newbie ...
3
votes
2answers
2k views

How do digital certificates work, and why is it not possible to reverse engineer one from a signed file?

Digital certificates are used quite commonly these days, for signing files. They are used by various operating systems to ensure reliability and security. For example, Android requires that each of ...
1
vote
2answers
140 views

Idea for secure password hash-likes, is this feasible/usable/workable?

(Hand moved from stackoverflow.com,due to suggestion) Since breaking password hashes has become a new passtime for scriptkiddies, I thought of the problem and came up with a novel(?) idea. store ...
2
votes
1answer
700 views

“Signing” with public key

For this question, the following caveats and assumptions hold: There exists a 2048-bit RSA key pair used exclusively for signing/verification The private key is kept completely private There exists ...
3
votes
2answers
122 views

When to prefer exchanging cryptographic certificates over exchanging only public keys?

Let's think of the following case: A group of peers want to exchange messages with each other. They use public-key cryptography to sign and encrypt messages. Anyone with any name can join the ...
3
votes
1answer
174 views

Safely use CryptSignAndEncryptMessage?

I am developing an application that sends messages which I want to encrypt and sign. The CryptoApi offers a function called CryptSignAndEncryptMessage. The description says, what this function ...
3
votes
2answers
998 views

Difficulty of breaking RSA for a given key size

Is it true that breaking a 1024-bit RSA key is as difficult as breaking a 128 bit symmetric key (e.g. AES)? I know that breaking a RSA key is equivalent to factoring the modulus $N$. To factor it, you ...
5
votes
1answer
4k views

Chinese Remainder Theorem and RSA

Wikipedia has a nice section regarding the speedup of the RSA decryption using the Chinese Remainder Theorem here. I need to understand the implementation of a similar speedup for the encryption ...
5
votes
1answer
622 views

Are there any MGF1 and OS2IP functions available in C?

I need MGF1 and OS2IP functions, as defined in the PKCS #1 v2.1: RSA Cryptography Standard. Is there anything available in OpenSSL, or any other open C library?
4
votes
2answers
2k views

Why DSA cannot be used for encryption?

Here it is mentioned that DSA cannot be used for encrypt. But Both RSA and DSA can be used to generate public and private keys, right? (Or am I wrong?). Then why can't I use the DSA public key to ...
-1
votes
1answer
194 views

How can we find Public key have only 8 or 16bits? How many messages does Eve need to know the Public key in RSA?

Suppose Alice sends messages to Bob by encrypting the messages with Bob's public key. Eve knows that the data is encrypted using RSA, but does not know the public key. Can Eve figure out the public ...
2
votes
2answers
367 views

Is it possible to figure out the public key from encrypted text?

Suppose Alice sends messages to Bob by encrypting the messages with Bob's public key. Eve knows that the data is encrypted using RSA, but does not know the public key. Can Eve figure out the public ...
3
votes
0answers
236 views

RSA reencryption scheme

Is there such an algorithm that would allow to upgrade the encryption of a RSA-encrypted message without revealing the plaintext to the untrusted user? Basically, such an algorithm would probably be ...
2
votes
3answers
433 views

RSA finding the inverse of the public exponent

I have a very basic doubt in RSA key generation and its usage. In RSA key generation you choose two large prime numbers of a very large order. Then you multiply them.(eq $p \cdot q = N$) Now, ...
6
votes
3answers
526 views

Security equivalence proofs for breaking RSA

It is my understanding that while a practical solution to the factoring problem will definitely break RSA, it has never been proven that the security of RSA is equivalent to factoring. In otherwords, ...
2
votes
1answer
1k views

How to sign a message using RSA?

Assuming I already have a D, P, Q, etc of an RSA key: How do I now sign a message? If it matters – the message is around 100 bits. I don't know much about cryptography, but I can get these numbers ...
2
votes
1answer
277 views

How are the primes used to generate RSA keys?

I am confused about how keys in RSA asymmetric encryption are generated and what the implications for open communications are. Textbooks say the one-way function is merely two primes (with some ...
5
votes
2answers
502 views

Can RSA encryption produce collisions?

In RSA, a message is encrypted by $m^e \pmod N$. $N$ is the modulus, $m$ is the message and $e$ is the public exponent. (I know that $m$ should not be greater than $N$.) My question is, can $m^e$ be ...
6
votes
1answer
421 views

Would RSA-encrypting a private key for itself constitute a vulnerability?

I'm planning to encrypt some individual files for storage, using the GnuPG implementation of RSA. If I happened to encrypt the private key corresponding to the public key used for encrypting -- either ...
1
vote
2answers
253 views

One-way function and factoring

I am confused about the hardness of the one-way function behind cryptography -- if someone could factor the large number produced back into two primes quickly then the one-way function would be ...
2
votes
2answers
4k views

How does a chosen plaintext attack on RSA work?

How can one run a chosen plaintext attack on RSA? If I can send some plaintexts and get the ciphertexts, how can I find a relation between them which helps me to crack another ciphertext?
1
vote
2answers
283 views

My custom handshake

I am a beginner in cryptography and I designed a custom handshake between 2 entities $\rm C$ (client) and $\rm S$ (server) which should meet the following requirements: Requirements: The handshake ...
6
votes
1answer
165 views

In RSA, rationale for prime $p$ with $p-1$ having prime factor $u$ with $u-1$ having large prime factor?

In the 1978 RSA paper, it is recommended, among other things, to choose primes $p$ such that $(p-1)$ has a large prime factor $u$. This was motivated by Pollard's p-1 algorithm. Further, the authors ...
7
votes
3answers
806 views

Is RSA padding needed for single recipient, one-time, unique random message?

I want a way to encrypt files using this process: http://crypto.stackexchange.com/a/15 . That is: generate a random password, use that to AES-encrypt a file, and use an RSA public key to encrypt the ...
4
votes
1answer
244 views

Why does RSA give better security on longer messages?

I am trying to understand the notion of RSA security. Choosing a public exponent where $e = 3$ facilitates the calculations, considering that it is secure if the plaintext or message is long. If the ...
5
votes
2answers
5k views

Difference between “Signature Algorithm” and “Signature Hash Algorithm” in X.509

What's the difference between the "Signature Algorithm" and the "Signature Hash Algorithm" found in an X.509 certificate? Why does it need a "Signature Hash Algorithm"? Edit: I'm creating the ...
4
votes
2answers
355 views

X.509 CSR: Why does CA remove signature?

I just read this article on Wikipedia: Certificate Signing Request I'm not a PKI or Crypto expert. As I understand, a CSR (certification request) is always signed by the PKCS#10-Request creator. ...
2
votes
1answer
161 views

RSA-OAEP versus RSA with Fujisaki-Okamoto construction

I was wondering why the Fujisaki-Okamoto construction (or one of its variants) is not (at least commonly) used with RSA to achieve CCA2 security? Does anyone know of any speed comparisons between RSA ...
4
votes
0answers
107 views

RSA security assumptions - does breaking the DLP also break RSA? [duplicate]

Possible Duplicate: Would the ability to efficiently find Discrete Logs have any impact on the security of RSA? I'm wondering if breaking the DLP, that is the basis for ElGamal and DSA, ...
3
votes
1answer
157 views

Signing a GCM MAC

If I encrypt a message with AES-GCM, is it safe to use the MAC as the hash in a DSA/RSA signature? That is, if someone knows the AES key and nonce, will they be able to generate a different message ...
6
votes
1answer
307 views

Threshold Signatures for RSA and DSA

I have a few questions relating to threshold signatures: a scheme where $n$ participants hold a key share and any $t$ of them can conduct a protocol using their shares that results in a valid RSA or ...
7
votes
1answer
351 views

Exposing RSA private-key data… bad?

We know that exposing $p$, or $q$ or $\phi(n)$ results in trivial attacks on RSA since they allow us to factor $n$ and to compute the private exponent $d$. In OpenSSL (and most RSA implementations) ...
4
votes
2answers
489 views

Does RSA padding have to be unpredictable if the payload is?

I'm trying to understand the precise requirements on padding when using RSA for encryption. Suppose Alice uses RSA to encrypt a payload $M$ that cannot be guessed (say, a random nonce): Alice send ...
5
votes
1answer
256 views

Anonymous trust/reputation system

Suppose there are 3 persons, Alice, Bob and Peter. They are identified by their pseudonyms (public RSA keys). Alice has a key Alice, Bob has ...
7
votes
1answer
777 views

How to better generate large primes: sieving and then random picking or random picking and then checking?

I'm writing an RSA algorithm, and am wondering what is the best and/or usual way to choose the initial prime numbers (p and q). I know of two methods to achieve this, one based on a prime number ...
3
votes
1answer
791 views

Is RSA of a random nonce with no padding safe?

Consider the following protocol: Bob has a private RSA key $B_{priv}$, and Alice knows the public key $B_{pub}$. Alice wants to send confidential messages to Bob (no integrity intended). To send a ...
6
votes
2answers
935 views

How much can we compress RSA public keys?

I am wondering to what degree we can define an RSA variant, with a security argument that it is as safe as regular RSA with a given modulus size $m$ (e.g. $m=2048$), in which the public key has a ...
3
votes
3answers
467 views

How can I avoid calculating with huge numbers when implementing the RSA algorithm

There is 26-letter English alphabet. There is the plain text: TRYAGAINLATER. I need to encrypt it by RSA algorithm with the public key 53. What is the ciphertext? ...
7
votes
1answer
2k views
2
votes
1answer
5k views

Calculating private keys in the RSA cryptosystem

The number $43733$ was chosen as base for an implementation of the RSA system. $M=19985$ is the message, that was encrypted with help of a public key $K=53$. What is the plaintext text? What is the ...
9
votes
2answers
8k views

When to use RSA and when ElGamal asymmetric encryption

If i am not wrong in cryptography there are 2 basic cryptographic schemes for public key cryptography. RSA encryption whose security is based on the infeasibility of solving the factoring of big ...