an asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption.

learn more… | top users | synonyms

2
votes
2answers
163 views

Publicly exposed hash of private key

Would exposing a cryptographic hash function's digest (e.g. SHA-3) of RSA private key data compromise the key? If so, what are the possible (cryptanalysis-) vectors for attacking the key if an ...
2
votes
1answer
2k views

Why does plain RSA not work with big messages ($m>n$)? [duplicate]

From what I can remember, RSA is something like this: Generate 2 distinct prime numbers $p$ and $q$ that have similar bit length. Compute $n=pq$ and $\phi(n)=(p-1)(q-1)$ Compute $e$ such that ...
2
votes
2answers
826 views

Computing p and q from private key

We are given n (public modulus) where n=pq and e (encryption exponent). Then I was able to crack the private key d, using Wieners attack. So now, I have (n,e,d). My question is, is there a way to ...
2
votes
1answer
758 views

RSA smaller number work-out-by-hand not working - I think I made a mistake

I tried out the paper/pencil explanation @ http://sergematovic.tripod.com/rsa1.html, and it seemed to make sense just fine until I came to decryption. Here is what I worked out: Key Creation: Choose ...
2
votes
1answer
820 views

How does OAEP improve the security of RSA?

The heart of OAEP algorithm used for RSA encryption are the cryptographic hash functions $H$ and $G$. Does everybody (so also an adversary) know these functions? If YES: How does it help the ...
2
votes
2answers
519 views

Why is the following RSA PRNG cryptographically secure?

One requirement states that the generator has to withstand the next-bit test. Consider the following PRNG, where we calculate next output $x_i$ via the formula $x_i = x_{i-1}^ e\mod n$. I can see ...
2
votes
2answers
953 views

risk of attacker decrypting RSA ciphertext without public or private key

As I describe in my previous question I am trying to decide if it's worth it for me to use the Offline Private Key Protocol in creating some long term private archives, instead of just going with a ...
2
votes
1answer
523 views

What algorithm does PGP use to encrypt email?

I know it uses RSA/DSA to create keys, but does it use that same algorithm for the actual cipher?
2
votes
1answer
134 views

Theoretical decryption of RSA

I am currently looking into RSA and have some questions. I am interested in theoretical answers, assuming there is infinite time for decryption. Is it necessary to work out the private-key exponent ...
2
votes
1answer
88 views

Why can you reverse a modulo function when knowing its primes

We are dealing with cryptography in school right now and superficially went over the Rabin cryptosystem with the (apparently usual) example of p=7 and q=11 etc (we didn't do RSA). I understand that ...
2
votes
2answers
92 views

Securely generating auth tokens

(Disclaimer: I'm an experienced server-side Java programmer, but with little crypto experience.) Objective: I've got a login server which, given a login+password pair, should issue a unique auth ...
2
votes
1answer
204 views

RSA vs ECDSA/ECDH

So we've been using RSA for a while now. I wonder, is it still secure? I'm wondering whether surveillance agencies can at this point read traffic encrypted with say, TLS_ECDH_RSA_WITH_AES_128_GCM? ...
2
votes
2answers
111 views

Inverting RSA function

I am in high school and I am writing a paper on RSA. I want to show that low values of the public key exponent can make it easy to 'invert' the function so that the encrypted message can be recovered. ...
2
votes
1answer
327 views

Attack for RSA 1024 bit with Low Public Exponent

I am facing a challenge at university. Our teacher give us the challenge to try to break an RSA 1024 bit. We have public modulus N and public exponent e (0x03), we don't know the padding. We have a ...
2
votes
2answers
208 views

RSA private key d knowing e,n

I need to find RSA private key $(d, N)$ knowing $(e, N)$. It's "own" RSA implementation. As i know $p$ is random 70 bit number, then $q$ is $p-2^{10} < q < p+2^{10}$ $d$ is max 16 bit long with ...
2
votes
1answer
157 views

How do we guarantee plaintext is coprime in RSA?

The specifications for RSA state: $P^{\phi(N)} \equiv 1 ~mod~N$ if and only if $P$ and $N$ are coprime. Here $P$ is the plaintext and $N$ is the product of two suitable primes $x_1, x_2$. My question ...
2
votes
1answer
468 views

The Boneh-DeMillo-Lipton fault attack (RSA CRT)

I am trying to understand the Boneh-DeMillo-Lipton fault attack on RSA CRT signature. Suppose that we sign a message $m$ with RSA-CRT : $d_p = d \bmod (p-1)$ and $d_q = d \bmod (q-1)$ $s_p = ...
2
votes
3answers
187 views

Feasibility of finding public key when private key is known

We all know that in a public key cryptosystem, given a public key it is extremely hard to compute private key from it. Is it the same case in reverse? Given a private key, how easy is it to compute ...
2
votes
1answer
152 views

Pick faster private exponent

I recently tried to send 1536-bit modulus CSR to COMODO. They refused to sign the certificate. I later found out that it's because NIST mandated 2048-bit modulus on the SSL certificate. I think it's ...
2
votes
2answers
547 views

Private RSA key for HMAC key

I am creating software tokens for future request authentication, and I want to use an HMAC for the token to make them tamper-resistant. To ensure I can check the HMAC later I need a secret, persistent ...
2
votes
1answer
2k views

Is it true that for RSA with no padding, the length of data must be equal to the length of key?

The question pertains not in terms of security but computing operational functionality, as it how the computation is done. Is it true that for RSA with no padding, the length of data must be equal to ...
2
votes
1answer
355 views

Where can I download a database of RSA keys?

I'm looking to do some research into how RSA is used in the wild. I've read through a few papers and it seems other researchers have had no trouble collecting millions of keys to perform analysis on. ...
2
votes
1answer
180 views

Why encrypting with private and public keys produce the same result?

Let say $e = 5$, $n = 119$ and $d = 77$. If I encrypt, for example, $m=15$ I get: $$m_1 = m^e=15 ^ 5 \mod 119 = 36\qquad\text{and}\qquad m_2 =m^d= 15 ^ {77} \mod 119 = 36$$. Why? Is it always like ...
2
votes
1answer
532 views

RSA 896 vs 1024 vs 2048 in Javascript?

I am currently working on a secure messaging website and I had been using RSA 2048 for encryption, decryption and signing of messages but I found it to be EXTREMELY LAGGY so i've moved to 1024. I did ...
2
votes
1answer
217 views

Which platforms are most vulnerable to Simple Power Analyse Attack

In a "Simple Power Analyse Attack", the difference in power consumption during multiply or square operation is used. In the RSA decryption process with the "Square and Multiply" algorithm, both ...
2
votes
3answers
764 views

RSA finding the inverse of the public exponent

I have a very basic doubt in RSA key generation and its usage. In RSA key generation you choose two large prime numbers of a very large order. Then you multiply them.(eq $p \cdot q = N$) Now, ...
2
votes
1answer
89 views

Is there an asymmetric algorithm that can perform double encryption?

I'm looking for any asymmetric algorithm can perform the serial encryption, by serial I mean double or more encryption with different key(same key size). RSA can not do it since the cipher of the ...
2
votes
2answers
101 views

Implementing RSA with small integers in CUDA

I have found some researches dedicated for speeding-up RSA calculations using CUDA. But I am wondering how they do that, given that the biggest unsigned int that could be declared in CUDA is 64 bit. ...
2
votes
2answers
86 views

How can a message encrypted with the public key be decrypted with the private key? [duplicate]

I've been reading about encryption and have a basic understanding of the concept. What I don't understand, however, is how a calculation with one key can result in a number that, through calculation ...
2
votes
1answer
92 views

Plaintext and ciphertext block sizes

How can you determine the largest plaintext block size and smallest ciphertext size if you used RSA with $n=59768553302699443$ using an alphabet with $27$ characters?
2
votes
1answer
204 views

Lattice based attack on RSA

Let $n=pq$ be the RSA module and at least one of $p,q$ is a weak prime.It is proved that the number of such $1024$bit $n$ is at least $2^{759}$. With lattices we can factor these $n$ in a second (I ...
2
votes
2answers
98 views

RSA and difference between factors

As I understand, for RSA $n = p \cdot q$. For the key to be safe enough from getting factored, $p$ and $q$ have to be far from each other. How far do they have to be? For example, if I have two ...
2
votes
2answers
118 views

Why does the time complexity of RSA encryption and decryption depend on the size of the modulus?

I would think that the time complexity would depend on the exponent, not the number of bits in the modulus. For example, if the exponent were 5, using the "naive" method, we would perform 5 ...
2
votes
1answer
146 views

Help understanding basic Franklin-Reiter related message attack

I am trying to understand this attack at the most basic level. I set up the following basic scenario: Let the public encryption exponent, e = 3. Let p, be some arbitrary but known (to the ...
2
votes
1answer
78 views

Diffie-Hellman using a different modulus on both sides

For Diffie-Hellman Key Exchange, the used modulus is the same throughout the process. Is it possible to use 2 different for both sides? For example, $A \gets M^{d_1} \pmod{n_1} $ $B\gets M^{d_2} ...
2
votes
1answer
87 views

Is there really any way to nullify or avoid MITM attacks?

The question pretty much sums it up. Is there any way to make an attacker who is successfully performing an MITM attack to actually not be able to read or change the messages? Assuming there is no ...
2
votes
1answer
128 views

Security impact of signing small data using RSA

I have an application which consists of a client and a server. Both have a pair of public and private key (RSA). For communication, both sign their messages and send them to the other part. So a ...
2
votes
1answer
274 views

Why isn't Rabin-Williams cryptosystem widely used?

I think we all know RSA. And of course we also know DJB (a.k.a. Daniel J. Bernstein). Now some already have noticed that he has an opinion towards cryptographic questions. In his 2008 paper ("RSA ...
2
votes
1answer
91 views

Retrieve value of private key after encryption with the public key

Is there a way to find an RSA private key after it is encrypted with the corresponding public key? Does there exist an algorithm to recover the private key in this special case?
2
votes
1answer
476 views

How multiplicative property of RSA can be exploited

It is known that RSA has the multiplicative property $E(m_1) \cdot E(m_2) = E(m_1 \cdot m_2)$ because $m_1^e \cdot m_2^e = (m_1 \cdot m_2)^e \pmod n$ But how can this property be used to break ...
2
votes
1answer
172 views

What use is the signature without the message under RSA?

Using RSA for signing & verification, is there a way to take a valid signature for an unknown message, and for someone else to generate a valid signature using a different key against the valid ...
2
votes
1answer
607 views

Deterministically generate a RSA public/private key pair from a passphrase (with sufficient entropy)?

Is it possible to deterministically generate public/private RSA key pairs from passphrases? Would giving the (key generating) algorithm data made from key-stretching the passphrase (instead of a ...
2
votes
1answer
485 views

Precomputation attacks on RSA

Are precomputation attacks - such as outlined in RFC 3610 chapter 5 - possible on RSA PKCS#1 v1.5 signature generation? If yes, are such attacks taken into account when calculating the cryptographic ...
2
votes
2answers
1k views

RSA Key Generation Parameters - public exponent, certainty, string-to-key count

I want to know what values are appropriate for the public exponent and certainty when generating an RSA Key (for example using Bouncy Castle RSAKeyGenerationParameters function). What is the ...
2
votes
1answer
868 views

Why should a signature use PSS padding in RSA?

Suppose I send a message using AES (private keys already negotiated securely) and I send a hash of this message using RSA (encrypted with private key) with OAEP to verify the authenticity and ...
2
votes
1answer
259 views

RSA key length choice for TLS when confidentiality not important?

I've a couple of questions about this, the scenario is embedding a key pair in a hardware device which will speak with other hardware devices over tls. computing resources are an issue so i want to ...
2
votes
1answer
724 views

Generate key pair deterministically from a particular seed [duplicate]

I've been reading "SQRL Secure QR Login" at Gibson's website, and I'm wondering if there is a way to generate an RSA private/public key-pair based on some cryptographically secure input, so that if ...
2
votes
2answers
175 views

Does it necessarily mean that an RSA moduli generated with poor randomness is not random?

In 2012 a group of researchers collected a large amount of RSA moduli and calculated their greatest common divisor in order to find common factors between them. By finding a common factor they could ...
2
votes
1answer
1k views

How is text converted to a number for RSA? [duplicate]

According to http://en.wikipedia.org/wiki/RSA_%28algorithm%29#Key_generation the key length is the number of bits in n. So how can a message of many megabytes (millions of bits) be modded by a 1024 ...
2
votes
1answer
69 views

Comprehension question on a signature protocol based on the RSA assumption

We have the following two-party protocol between Alice and Bob. Alice sends messages $m_1, m_2, \ldots \in_R \mathbb{Z}_n^*$ to Bob and Bob signs these values by calculating $v_1, v_2, \ldots \in_R ...