an asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption.

learn more… | top users | synonyms

2
votes
2answers
2k views

RSA Proof of Correctness

Can anyone provide an extended (and well explained) proof of correctness of the RSA Algorithm? And why is it needed? I can't say that this or this helped me much, I'd like a more detailed and newbie ...
3
votes
2answers
2k views

How do digital certificates work, and why is it not possible to reverse engineer one from a signed file?

Digital certificates are used quite commonly these days, for signing files. They are used by various operating systems to ensure reliability and security. For example, Android requires that each of ...
1
vote
2answers
142 views

Idea for secure password hash-likes, is this feasible/usable/workable?

(Hand moved from stackoverflow.com,due to suggestion) Since breaking password hashes has become a new passtime for scriptkiddies, I thought of the problem and came up with a novel(?) idea. store ...
2
votes
1answer
790 views

“Signing” with public key

For this question, the following caveats and assumptions hold: There exists a 2048-bit RSA key pair used exclusively for signing/verification The private key is kept completely private There exists ...
3
votes
2answers
123 views

When to prefer exchanging cryptographic certificates over exchanging only public keys?

Let's think of the following case: A group of peers want to exchange messages with each other. They use public-key cryptography to sign and encrypt messages. Anyone with any name can join the ...
3
votes
1answer
182 views

Safely use CryptSignAndEncryptMessage?

I am developing an application that sends messages which I want to encrypt and sign. The CryptoApi offers a function called CryptSignAndEncryptMessage. The description says, what this function ...
3
votes
2answers
1k views

Difficulty of breaking RSA for a given key size

Is it true that breaking a 1024-bit RSA key is as difficult as breaking a 128 bit symmetric key (e.g. AES)? I know that breaking a RSA key is equivalent to factoring the modulus $N$. To factor it, you ...
5
votes
1answer
4k views

Chinese Remainder Theorem and RSA

Wikipedia has a nice section regarding the speedup of the RSA decryption using the Chinese Remainder Theorem here. I need to understand the implementation of a similar speedup for the encryption ...
5
votes
1answer
670 views

Are there any MGF1 and OS2IP functions available in C?

I need MGF1 and OS2IP functions, as defined in the PKCS #1 v2.1: RSA Cryptography Standard. Is there anything available in OpenSSL, or any other open C library?
4
votes
2answers
2k views

Why DSA cannot be used for encryption?

Here it is mentioned that DSA cannot be used for encrypt. But Both RSA and DSA can be used to generate public and private keys, right? (Or am I wrong?). Then why can't I use the DSA public key to ...
0
votes
1answer
210 views

How can we find Public key have only 8 or 16bits? How many messages does Eve need to know the Public key in RSA?

Suppose Alice sends messages to Bob by encrypting the messages with Bob's public key. Eve knows that the data is encrypted using RSA, but does not know the public key. Can Eve figure out the public ...
3
votes
2answers
381 views

Is it possible to figure out the public key from encrypted text?

Suppose Alice sends messages to Bob by encrypting the messages with Bob's public key. Eve knows that the data is encrypted using RSA, but does not know the public key. Can Eve figure out the public ...
3
votes
0answers
249 views

RSA reencryption scheme

Is there such an algorithm that would allow to upgrade the encryption of a RSA-encrypted message without revealing the plaintext to the untrusted user? Basically, such an algorithm would probably be ...
2
votes
3answers
445 views

RSA finding the inverse of the public exponent

I have a very basic doubt in RSA key generation and its usage. In RSA key generation you choose two large prime numbers of a very large order. Then you multiply them.(eq $p \cdot q = N$) Now, ...
6
votes
3answers
547 views

Security equivalence proofs for breaking RSA

It is my understanding that while a practical solution to the factoring problem will definitely break RSA, it has never been proven that the security of RSA is equivalent to factoring. In otherwords, ...
2
votes
1answer
1k views

How to sign a message using RSA?

Assuming I already have a D, P, Q, etc of an RSA key: How do I now sign a message? If it matters – the message is around 100 bits. I don't know much about cryptography, but I can get these numbers ...
2
votes
1answer
300 views

How are the primes used to generate RSA keys?

I am confused about how keys in RSA asymmetric encryption are generated and what the implications for open communications are. Textbooks say the one-way function is merely two primes (with some ...
5
votes
2answers
536 views

Can RSA encryption produce collisions?

In RSA, a message is encrypted by $m^e \pmod N$. $N$ is the modulus, $m$ is the message and $e$ is the public exponent. (I know that $m$ should not be greater than $N$.) My question is, can $m^e$ be ...
6
votes
1answer
428 views

Would RSA-encrypting a private key for itself constitute a vulnerability?

I'm planning to encrypt some individual files for storage, using the GnuPG implementation of RSA. If I happened to encrypt the private key corresponding to the public key used for encrypting -- either ...
1
vote
2answers
264 views

One-way function and factoring

I am confused about the hardness of the one-way function behind cryptography -- if someone could factor the large number produced back into two primes quickly then the one-way function would be ...
3
votes
2answers
4k views

How does a chosen plaintext attack on RSA work?

How can one run a chosen plaintext attack on RSA? If I can send some plaintexts and get the ciphertexts, how can I find a relation between them which helps me to crack another ciphertext?
1
vote
2answers
291 views

My custom handshake

I am a beginner in cryptography and I designed a custom handshake between 2 entities $\rm C$ (client) and $\rm S$ (server) which should meet the following requirements: Requirements: The handshake ...
6
votes
1answer
169 views

In RSA, rationale for prime $p$ with $p-1$ having prime factor $u$ with $u-1$ having large prime factor?

In the 1978 RSA paper, it is recommended, among other things, to choose primes $p$ such that $(p-1)$ has a large prime factor $u$. This was motivated by Pollard's p-1 algorithm. Further, the authors ...
7
votes
3answers
843 views

Is RSA padding needed for single recipient, one-time, unique random message?

I want a way to encrypt files using this process: http://crypto.stackexchange.com/a/15 . That is: generate a random password, use that to AES-encrypt a file, and use an RSA public key to encrypt the ...
4
votes
1answer
245 views

Why does RSA give better security on longer messages?

I am trying to understand the notion of RSA security. Choosing a public exponent where $e = 3$ facilitates the calculations, considering that it is secure if the plaintext or message is long. If the ...
6
votes
2answers
6k views

Difference between “Signature Algorithm” and “Signature Hash Algorithm” in X.509

What's the difference between the "Signature Algorithm" and the "Signature Hash Algorithm" found in an X.509 certificate? Why does it need a "Signature Hash Algorithm"? Edit: I'm creating the ...
4
votes
2answers
368 views

X.509 CSR: Why does CA remove signature?

I just read this article on Wikipedia: Certificate Signing Request I'm not a PKI or Crypto expert. As I understand, a CSR (certification request) is always signed by the PKCS#10-Request creator. ...
2
votes
1answer
169 views

RSA-OAEP versus RSA with Fujisaki-Okamoto construction

I was wondering why the Fujisaki-Okamoto construction (or one of its variants) is not (at least commonly) used with RSA to achieve CCA2 security? Does anyone know of any speed comparisons between RSA ...
3
votes
0answers
108 views

RSA security assumptions - does breaking the DLP also break RSA? [duplicate]

Possible Duplicate: Would the ability to efficiently find Discrete Logs have any impact on the security of RSA? I'm wondering if breaking the DLP, that is the basis for ElGamal and DSA, ...
4
votes
1answer
167 views

Signing a GCM MAC

If I encrypt a message with AES-GCM, is it safe to use the MAC as the hash in a DSA/RSA signature? That is, if someone knows the AES key and nonce, will they be able to generate a different message ...
6
votes
1answer
319 views

Threshold Signatures for RSA and DSA

I have a few questions relating to threshold signatures: a scheme where $n$ participants hold a key share and any $t$ of them can conduct a protocol using their shares that results in a valid RSA or ...
7
votes
1answer
358 views

Exposing RSA private-key data… bad?

We know that exposing $p$, or $q$ or $\phi(n)$ results in trivial attacks on RSA since they allow us to factor $n$ and to compute the private exponent $d$. In OpenSSL (and most RSA implementations) ...
3
votes
2answers
524 views

Does RSA padding have to be unpredictable if the payload is?

I'm trying to understand the precise requirements on padding when using RSA for encryption. Suppose Alice uses RSA to encrypt a payload $M$ that cannot be guessed (say, a random nonce): Alice send ...
5
votes
1answer
274 views

Anonymous trust/reputation system

Suppose there are 3 persons, Alice, Bob and Peter. They are identified by their pseudonyms (public RSA keys). Alice has a key Alice, Bob has ...
2
votes
1answer
837 views

Is RSA of a random nonce with no padding safe?

Consider the following protocol: Bob has a private RSA key $B_{priv}$, and Alice knows the public key $B_{pub}$. Alice wants to send confidential messages to Bob (no integrity intended). To send a ...
6
votes
2answers
991 views

How much can we compress RSA public keys?

I am wondering to what degree we can define an RSA variant, with a security argument that it is as safe as regular RSA with a given modulus size $m$ (e.g. $m=2048$), in which the public key has a ...
3
votes
3answers
489 views

How can I avoid calculating with huge numbers when implementing the RSA algorithm

There is 26-letter English alphabet. There is the plain text: TRYAGAINLATER. I need to encrypt it by RSA algorithm with the public key 53. What is the ciphertext? ...
7
votes
1answer
2k views
2
votes
1answer
6k views

Calculating private keys in the RSA cryptosystem

The number $43733$ was chosen as base for an implementation of the RSA system. $M=19985$ is the message, that was encrypted with help of a public key $K=53$. What is the plaintext text? What is the ...
10
votes
2answers
8k views

When to use RSA and when ElGamal asymmetric encryption

If i am not wrong in cryptography there are 2 basic cryptographic schemes for public key cryptography. RSA encryption whose security is based on the infeasibility of solving the factoring of big ...
8
votes
3answers
2k views

Is it possible to validate a Public Key in RSA?

If I have a 1024-bit number, and someone is telling me that it is in fact a valid RSA public key, is there any way I can quickly validate that it is indeed so (without cracking RSA)? (I suppose I am ...
1
vote
0answers
78 views

Two untrusted party want to exchange data: how to ensure each one gets the data it needs? [duplicate]

Possible Duplicate: Two untrusted party want to exchange data: how to insure each one gets the data it needs? I am trying to come up with what could maybe be a novel algorithm for an ...
28
votes
3answers
8k views

How can I use asymmetric encryption, such as RSA, to encrypt an arbitrary length of plaintext?

RSA is not designed to be used on long blocks of plaintext like a block cipher, but I need to use it to send a large message. How can I do this?
5
votes
1answer
149 views

Including a “purpose” designation in a digital signature

A signature of some data can mean many different things, such as: This is a message I sent, this is a certificate I validated,... So I was surprised that common signing schemes don't include a ...
3
votes
1answer
1k views

RSA: If n=35, show that e will equal d

Show that if $n = 35$ is used as an RSA modulus then the encryption exponent $e$ always equals the decryption exponent $d$? What I have so far: $n = 35$ Therefore $p = 5$ and $q = 7$ or vice versa, ...
3
votes
2answers
919 views

Proof of security for RSA signatures

I am new to here, I was having some problems with a problem I am working on: "For each of the following variants of the definition of security for signatures, state whether textbook RSA is secure ...
4
votes
1answer
865 views

Why is ElGamal considered non-deterministic?

One difference between RSA and ElGamal is that ElGamal isn't necessarily deterministic (while RSA is). What makes it non-deterministic? Is this advantageous to security? How else does this property ...
5
votes
2answers
712 views

How do I solve this RSA instance for m?

How we can solve this equation and get the value of M? $$8 = M^{13} \mod 33$$ not a computer program, but a mathematical operation.
3
votes
1answer
946 views

Demonstrating the insecurity of an RSA signature encoding scheme

I'm working on problem 12.4 from Katz-Lindell. The problem is as follows: Given a public encoding function $\newcommand{\enc}{\operatorname{enc}}\enc$ and a textbook RSA signature scheme where ...
5
votes
2answers
4k views

Cracking plain RSA without private key

I was wondering whether plain RSA encryption can be cracked given: The public key A plaintext of a known cipher text(s). In other words the decrypted message from an encrypted one (but without ...