an asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption.

learn more… | top users | synonyms

8
votes
2answers
661 views

Can RSA encryption produce collisions?

In RSA, a message is encrypted by $m^e \pmod N$. $N$ is the modulus, $m$ is the message and $e$ is the public exponent. (I know that $m$ should not be greater than $N$.) My question is, can $m^e$ be ...
0
votes
1answer
79 views

Negative exponents in Shoup's threshold RSA?

I'm trying to implement threshold RSA operations, starting with decryption based on Peeters, R., Nikova, S., & Preneel, B. (2008). Practical RSA Threshold Decryption for Things That Think. ...
0
votes
1answer
78 views

Proof that $gcd(e, \lambda(N)) = 1 \hspace{1mm} \Longleftrightarrow \hspace{1mm} gcd(e, \varphi(N)) = 1$

What is the proof for the fact that $gcd(e, \lambda(N)) = 1 \hspace{1mm} \Longleftrightarrow \hspace{1mm} gcd(e, \varphi(N)) = 1$ Where: $N = P * Q$ where $P$ and $Q$ are both primes. $\varphi(N)$ ...
1
vote
1answer
196 views

Can public key be recovered from ciphertext & encrypted private key?

I'd like to implement something like a write-once public/private encrypted shared secret (no better quick description for the lack of terminology knowledge). I guess, I'm trying to implement HSM. The ...
0
votes
0answers
21 views

Reducing key shares in Damgård-Dupont threshold RSA

I'm working on understanding and implementing Damgård, I., & Dupont, K. (2005). Efficient Threshold RSA Signatures with General Moduli and No Extra Assumptions. Public Key Cryptography-PKC ...
5
votes
2answers
373 views

State of the art RSA key generation

I would like to know if there is an algorithm to generate a RSA key at the state of the art of the present cryptanalysis. Beside the key lenght I know there are some weakness in the choice of prime ...
5
votes
3answers
1k views

Why should the RSA private exponent have the same size as the modulus?

Consider the generation of an RSA key pair with a given modulus size $n$ and a known, small public exponent $e$ (typically $e = 3$ or $e = 65537$). A common method is to generate two random primes ...
2
votes
3answers
285 views

In RSA, why does $p$ have to be bigger than $q$ where $n=p \times q$?

In openSSL – during RSA key generation – if $q$ is bigger than $p$, they exchange them. Why is that?
2
votes
1answer
219 views

2048-bit RSA Decryption

If a message is encoded with 2048 bit RSA. The ciphertext is $M^e mod N$. In some cases, the message is short, $ M \approx 10^{20} $. With a high probability, $M$ can be written as $M = ab$ with $a, b ...
0
votes
1answer
54 views

RSA: How effective is this keypair-trash attack [duplicate]

A question that could very well be part of xkcd's "what if?": Let's say Monica made a piece of software that sends all RSA keypairs to a central database after they're not used anymore. Something ...
1
vote
1answer
58 views

x509 Certificate Signature

I've got a question about the signature of a CA. As I understand, the CA takes the public key of the client and signs it with his own private key by using "md5WithRSAEncryption" (like explained here: ...
-3
votes
2answers
92 views

Selection of cryptographic functions for OAEP

I can't understand how the "cryptographic functions" are to be selected RSA + OAEP which are used in OAEP. How to choose these "cryptographic functions"(G and H)?
0
votes
0answers
42 views

Is signing a message just encrypting it with private key? [duplicate]

I have a simple question, When I sign a message (in RSA) does the program encrypt the text with my private key? Because I can decrypt it with my public key. Yes or no. Is signing a message just ...
-1
votes
1answer
86 views

RSA: how does it work and how is it more secure than symmetric systems

Before starting the question, I know that RSA is naturally a key exchange cryptosystem rather than an antilogarithm fully implemented for encrypting and decrypting data since the length of the secret ...
1
vote
1answer
50 views

Is it a variant of Strong RSA assumption?

Informally, the hardness of RSA/Strong RSA assumption lies in the hardness of factoring a large composite number $N$ having two large primes as its factors. If RSA modulus $N$ is a prime number, then ...
0
votes
2answers
98 views

How does RSA padding work exactly?

I've read everywhere online and people say plain text RSA is very unsafe. To make it safe you pad it but no examples are shown anywhere on how to do it. It's explained that random data is added to the ...
-2
votes
1answer
42 views
1
vote
3answers
134 views

RSA Key generation: How is multiplicative inverse computed?

As per Wikipedia, RSA keygen goes like this: Choose two distinct prime numbers p and q. Compute $n = pq$. Compute $\varphi(n) = (p − 1)(q − 1)$. Choose an integer e such that $1 < e < ...
0
votes
1answer
131 views

Find private exponent in RSA

The other answers for this confuse me, I know the principle of d in terms of the equation it has to satisfy. However I'm not sure how I would go about finding the private exponent without trial and ...
36
votes
5answers
8k views

How big an RSA key is considered secure today?

I think 1024 bit RSA keys were considered secure ~5 years ago, but I assume that's not true anymore. Can 2048 or 4096 keys still be relied upon, or have we gained too much computing power in the ...
-1
votes
1answer
63 views

Montgomery and Galois fields

I'm a little bit confused about the design of a RSA module in VHDL. My question isn't directly related to hardware design. I've read a lot of publications and I bought also a book. In one publications ...
0
votes
0answers
109 views

Two questions on EMSA-PKCS1-v1_5

If I implement EMSA-PKCS1-v1_5 in the following two non-standard ways, what kind of things could go wrong? The padding structure will be referred as (00|01|PS|00|DER(Digest Algo)|Digest), where | is ...
0
votes
2answers
93 views

RSA signing security

I'm curious about the security of RSA signing with the same public private key pair when the same message is sent multiple times. It's my understanding that once you generate the hash of the message ...
0
votes
0answers
62 views

RSA public key exponent generation confusion

Quote from Wiki: $e$ having a short bit-length and small Hamming weight results in more efficient encryption — most commonly $2^{16} + 1 = 65537$. However, much smaller values of $e$ (such as $3$) ...
1
vote
1answer
127 views

Montgomery Algorithm

I'm trying to undestand how it works and how to implement the algo described in this paper. The paper shows a methods to compute a modular multiplication where it is used multiplier with a resolution ...
0
votes
1answer
79 views

Is RSA with SHA1 broken?

I am using CryptSignMessage to sign a string/file. Is using RSASha1 insecure? I know Sha1 is broken as a hashing algorithm, but does that also mean that using it for signing with RSA is broken?
0
votes
3answers
255 views

Implementing a web app where the server cannot decrypt its own data?

I'm a cryptography novice, but I think that the world needs to move towards an "encrypt everything" mentality as much as possible. As a result, I've been thinking a lot about ways to build a web app ...
0
votes
2answers
140 views

Factors of RSA modulus

In the article A Method for Obtaining Digital Signatures and Public-Key Cryptosystems, the original RSA article, it is mentioned that Miller has shown that n (the modulus) can be factored using any ...
0
votes
0answers
27 views

How to find the factors of the modulus? [duplicate]

In the article "A Method for Obtaining Digital Signatures and Public-Key Cryptosystems", the original RSA article, it is mentioned that Miller has shown that n (the modulus) can be factored using any ...
1
vote
1answer
76 views

ASN.1 encoding off RSASSA-PSS default parameters

I am not totally sure the question belongs to crypto and not stackoverflow but nevertheless... The problem is the encoding of the RSASSA-PSS default algorithm identifier parameters in an X509 ...
0
votes
3answers
55 views

private keys for multiple devices [closed]

I have an architecture where: a user can have multiple devices (phones) the server needs to broadcast the payload to all devices through the same channel (basically, all devices listen and receive ...
1
vote
1answer
83 views

Strength of RSA with OAEP

In our current system we use an encryption solution based on RSA with OAEP padding. Key size is optional but default 2048. What is the general strength of RSA with OAEP? Are there know attacks that ...
4
votes
3answers
455 views

P = NP and current cryptographic systems

I've recently heard some people claiming that if the fact that P = NP is proven, most (all?) the current cryptographic algorithm considered secure like RSA will be unusable in secure systems. My ...
3
votes
5answers
523 views

What is the SSL private key file format?

I was researching about how to encrypt with RSA. I understood everything but not the format of the private keys. In the phpseclib (RSA in PHP), you can import your private key (private.key format) ...
1
vote
1answer
73 views

Why are cryptographically secure hashes required for digital signing (RSA or DSA)?

I know that a cryptographically secure hashing algorithm is required for proper message signing (SHA-1, or I think SHA-2 is the current suggested algorithm). However, why does the hashing algorithm ...
8
votes
2answers
3k views

Why hash the message before signing it with RSA?

The diagram below illustrates the process of digitally signing a message with RSA: As diagram shows, the message is first hashed, and the signature is then computed on the hash, rather than on the ...
0
votes
1answer
59 views

How exactly to extract information base 10 from a PGP RSA key pair?

I think I understand the mathematics of RSA ok. I'm not so computer savvy though. How, exactly, can I extract $n$, $e$, $d$, $p$ and $q$ from a PGP RSA public key pair? Is there like a converter ...
1
vote
1answer
3k views

RSA 4096 bit key benchmark

How can I benchmark RSA operations on my computer? I want to know about 4096-bit long keys on general computers. How many encryptions and decryptions are possible per second? All benchmarks I found ...
0
votes
0answers
72 views

RSA - Why should we sign hash rather than raw content? [duplicate]

Apart from obvious performance considerations, is there any mathematical or crypto reasons that imply that we sign a hash rather than a raw content ? I read that it was because the hash must fit in ...
3
votes
0answers
68 views

Relations between RSA and DLOG, factoring and DLOG

Definition: (The generalized Diffie-Hellman problem) Let $n=pq$ for two large primes $p,q$. Given $x, x^a, x^b,n$, find $x^{ab}\pmod{n}$. (1) Is there a known reduction from the GDH problem ...
3
votes
2answers
611 views

How much extra information is in an RSA public key?

I'm trying to calculate the size of an RSA public key in Ruby. I've retrieved the key in PEM format, and once I've decoded the base64 part from the PEM format, I get the size in bytes. What I find is ...
3
votes
2answers
237 views

Does RSA operate over a Finite Field (Galois Field)?

Is it correct to say that RSA operates over a Finite Field (Galois Field)? In this case GF(p)? I do understant that the modulo in RSA is not itself a prime number, but all the operations ...
0
votes
1answer
90 views

Possible to know who is the owner of a message encrypted with RSA public key

Given the scenario in which I want to send 10 messages either to Stalio or Olio. I encrypt these messages with their respective public keys using textbook RSA, before sending the messages to their ...
0
votes
0answers
47 views

Is basic RSA secure? [duplicate]

I'm pretty new to cryptography, had RSA in my math lectures a few years back and decided to try it myself. I've implemented a rather basic version of RSA using a hash from a passphrase to create the ...
8
votes
4answers
294 views

How are random numbers for RSA generated? [duplicate]

The RSA public key encryption requires two very large prime numbers as part of its encryption process that serve as secrets. These are typically generated with cryptographically secure random number ...
2
votes
2answers
123 views

how to let other people respond to emails only decrypt-able with my private key

First of all I have to say it's a homework question but since I have no one to consult with, I ended up here :) Suppose a case in which you are the manager of a company and all employees encrypt ...
2
votes
1answer
69 views

For which RSA moduli, precisely, is $e=d$ for all $e$?

This question shows that there are at least two valid RSA moduli $n$, namely $35$ and $91$, such that for any $e$ coprime to $\lambda(n)$, $$e^2\equiv1\mod\lambda(n)\text.$$ Reading the linked ...
2
votes
2answers
7k views

OTP from Sony BIOS password recover [closed]

From Dogbert's blog: Sony has a line of laptops ("Vaio") which compete mainly in the high value market segments. They implemented a master password bypass which is rather sane in comparison to the ...
1
vote
1answer
64 views

RSA Protocol behind Yaksha Security System

So I'm reading over the Yaksha Security System and see it is based on the RSA cryptosystem and a centralized server, easy enough. What I'm slightly confused on is the math behind the related keys. It ...
2
votes
3answers
3k views

RSA Proof of Correctness

Can anyone provide an extended (and well explained) proof of correctness of the RSA Algorithm? And why is it needed? I can't say that this or this helped me much, I'd like a more detailed and newbie ...