an asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption.

learn more… | top users | synonyms

0
votes
1answer
25 views

X509 Cert exploit CA check

Assumptions Let's theoretically assume that a browser skips the check that a certificate it receives belongs to the stated CA (that's an exercise). How could I exploit this in order to impersonate ...
1
vote
0answers
39 views

Issue Factorization Quadratic Sieve

Good evening, I'm about to write my own quadratic sieve implementation in C using GMP library for large numbers. I'm facing an issue while attempting to do the last factorization step for the number: ...
0
votes
1answer
19 views

Digital signature with collision

Let's assume a digital signature scheme such that there's a probability of 0.2 for two random messages to have the same signature. How can I exploit this sheme? I'm having difficulties in finding an ...
0
votes
1answer
55 views

Why is it better to have the private key as the multiplicative inverse mod phi(n) in RSA?

I'm studying the RSA algorithm and the theory says to select $d$ to be the multiplicative inverse of. $$ e \mod \phi(n) $$ If we take this approach I know that it is important that $e$ and $\phi(...
3
votes
2answers
82 views

Chosen-Message-Attack RSA-Signature

I know that because of the multplicative property of RSA $s =(s_1s_2) \bmod n = (m_1m_2)^d \bmod n$ If Oscar wants to sign now an own message $m$ he chooses another message $m_1$ with $\gcd(m_1,n)=...
34
votes
5answers
6k views

In RSA, how does the CPU deal with this huge modulus (8192 bits)?

Whilst I understand how the RSA algorithm works, I don't understand how the CPU operates when it needs to use the mod function with a huge number $n$, for example. ...
1
vote
2answers
73 views

Why is padding the plaintext with a random string before encryption worse than OAEP / PKCS#7?

I'm reading about OAEP / PKCS padding used for PGP to turn deterministic algorithms like RSA from deterministic encryption to probabilistic encryption (randomness in the resulting output). That way ...
4
votes
1answer
432 views

How to sign a large file for random-access reading?

I need to write an "Authoring" application which produces large files. These files must be signed so that the "Consuming" application knows that it was authored with a matching key. The consuming ...
3
votes
0answers
102 views

How to generate an RSASSA-PSS signature with MGF1-SHA256?

As part of rooting a device, I need to generate a 256-byte RSASSA-PSS signature using SHA256 as the hash and MGF1-SHA256 as the mask function, for an update file I created. I can choose any 32-byte ...
0
votes
3answers
116 views

Can $d$ and $e$ be the same number in RSA?

I'm reading about RSA and I have doubts: 1) To choose $e$, this value have to be between $1$ and $\phi=(p-1)(q-1)$, with $\gcd(\phi, e) = 1$, right? 2) In my example, $p = 139$ and $q = 491$. So $n =...
3
votes
3answers
117 views

Can an adversary distinguish a private key from a pseudo-random string of the same length?

Apologies if this is a dumb question but allow me to describe the dilemma I have: Suppose that I am protecting a private key on a device using a password & PBKDF2. The obvious attack would be an ...
19
votes
4answers
4k views

Why does RSA need p and q to be prime numbers?

This is a clarifying thread after finding: What makes RSA secure by using prime numbers?. Despite the fact that this question was answered already, I am still struggling to really grasp the ...
4
votes
1answer
133 views

What is the major difference between FIPS 186-2 and FIPS 186-4?

Can anyone please tell me the major difference between FIPS 186-2 and FIPS 186-4? I know with FIPS 140-2 they want the DSS standard to be FIPS 186-4, but what difference does it make?
0
votes
1answer
57 views

What is proper size of window Using RSA Window method?

I want to Use Window method for RSA modular Exponentiation. because of SCA. But I don`t know what is proper window size.
4
votes
2answers
125 views

RSA 3072 is 65,536 more difficult to factor than 2048?

If RSA 3072 is equal to 128 bit symmetric and 2048 is equal to 112 bit symmetric then 128-112= 16 and 2^16= 65,536. In that case wouldn't this make 3072 more future proof against quantum computers or ...
1
vote
1answer
31 views

How to add passphrase to an RSA key?

If I want to protect a private RSA key, do I just XOR the password into the key, or do I do something else? Is it secure? Edit: I got a good answer from a comment - Hash the password/passphrase with ...
0
votes
1answer
91 views

New Improved Probabilistic version of RSA

On the 2nd page of "New probabilistic public-key encryption based on the RSA cryptosystem" by Roman'kov (PDF), at last it says Alice can find "f" of order "l" with least probability of (1-1/l). I ...
0
votes
1answer
46 views

How do you work out the private key in a RSA cryptosystem knowing a certain public key?

The public key: n = 85 and e = 19 I know that n is the product of two prime numbers, now is it right of me to figure them out by process of elimination which I got p or q equals 17 and 5. Or is ...
0
votes
1answer
75 views

How to decrypt an RSA ciphertext given an oracle providing the lower 8 bits of decryptions?

I have access to an oracle that can encrypt and partially decrypt a number with RSA-1024 algorithm. For encryption: \begin{equation} C = M^e\bmod n \end{equation} But for decryption, result will ...
3
votes
1answer
188 views

What is the probability of attacking SHA1 used in RSA signature with small exponent?

There is RSA signature check which has following properties: RSA modulus N which is 2048-bit RSA public exponent equal 41 (0x29) Genuine Signature uses EMSA-PKCS1-v1_5 padding of SHA1 hash, however ...
2
votes
1answer
99 views

RSA Encryption problem for Discrete Math

I am doing practice problems for my upcoming final exam, and am having trouble with this RSA encryption problem. If any one could check to see if i did these correctly, it would be greatly appreciated....
2
votes
1answer
59 views

How can I show RSA OAEP IND-CPA secure

How can I show, that RSA with OAEP is IND-CPA secure by using G,H one way function?
1
vote
0answers
53 views

Encrypting/Decrypting using RSA and AES; standards?

I'm looking for a standard way of encrypting and signing a message using RSA and AES. I understand that in pseudo code the actions taking place are like this: Alice's actions for sending a secret, ...
4
votes
2answers
72 views

RSA: select $e$ given $n$ and $\varphi(n)$

I have a question for a course I am doing. In an RSA question, it asks "Is it possible to select $e$ in such a way that it coincides with the corresponding private key $d$? If it is possible, provide ...
7
votes
1answer
227 views

How many qubits are required to break RSA 2048 or 4096 with a universal quantum computer?

So in the news this week, IBM have created a universal quantum computer with 5 fully functional qubits. Logic and Moore's law dictates they will be able to scale this up to a lot more qubits within a ...
-4
votes
1answer
74 views

How to find $e$ when $p,q,d$ are given?

I have solved till here ..... $$n=p*q$$ $$n=5*11$$ $$\varphi(n)=(p-1)*(q-1)=4*10=40$$ Now, how to find $e$, when $d$ is given as $27$ and message for encryption is $\text{abcdefghij}$. We have to take ...
-2
votes
1answer
122 views

Decrypting an RSA message given $a^2 \equiv 1 \pmod n$

I need help with a practice problem for an upcoming test. I've learned the answer to the problem is "well done", but don't know how to get there. Any help is greatly appreciated. Suppose that the ...
5
votes
2answers
178 views

Should RSA primes p and q differ in length by “a few digits”?

When generating RSA keys in the original RSA paper it is stated: to gain additional protection against sophisticated factoring algorithms, p and q should differ in length by a few digits Why is ...
0
votes
0answers
24 views

Securely register a client in server using AES an RSA

I've designed the following protocol to send the client's public key to the server. Initially, the client knows server's public key, but the server does not know the client's public key. client ...
0
votes
1answer
56 views

How to use the hardcoded server's public key to register a client application?

I'm designing the security for a smartphone app that can be used to make car reservations. Clients have to register them with their driver's licence through the application and can then book a car. ...
1
vote
0answers
54 views

Is it possible to enumerate the possible RSA keys? [duplicate]

As far as I understand ECDSA keys are smaller than RSA because all of the value of the ECDSA (up to a high number) are valid private keys. Is there any method of compressing RSA keys, based on some ...
1
vote
2answers
136 views

Where is the mistake in my RSA by-hand calculation?

Like several previous askers, I seem to have made a mistake in my RSA calculation, but despite going back over it three times, I cannot spot it. I picked 1000003 and 6000011 as my primes, ...
0
votes
0answers
17 views

Is AES-256 bit encryption secure against this kind of attack? [duplicate]

Recently I came across this article. http://www.cs.tau.ac.il/~tromer/acoustic/ Could this put all computers at risk for decryption?
1
vote
1answer
52 views

Can I get successful signature verification with just altering message and signature?

Assuming I can modify a message and also modify the verification signature, and I also have the public-key but not the private-key. Can I create a message that can be verified with a signature that I ...
9
votes
1answer
265 views

Algorithm for Boneh and Durfee attack on RSA

I am trying to understand various attacks on RSA and I believe that they only way to fully understand the algorithm is to implement it. I am trying to implement the code in this paper (pdf) (Private ...
4
votes
1answer
97 views

What is the private key in RSA?

I'm new to cryptography and I have a doubt: I read some pages a bit different definition for the RSA private key: In 1 - (n, d) In 2 - ...
11
votes
2answers
1k views

RSA encryption using multiplication

Generally in RSA we encrypt as $m^e \pmod n$. Will RSA work if we replace the power by normal multiplication? $E = (m \times e) \mod n$ and decryption as $c \times d \mod n$. What will be $d$ ...
1
vote
0answers
69 views

How to use OpenSSL command line utility to encrypt data with encrypted key from public key?

I may not be asking the right question. I am fairly new to data encryption. I am currently being sent encrypted data that's stored as follows: [ [keysize] [key encrypted with public key] [ivsize] [...
0
votes
1answer
159 views

In RSA. Why is $\phi(n)$ kept secret and $n$ is public?

I mean, $n$ can also be easily used to find the factors $p$ and $q$ right?
3
votes
1answer
150 views

Trying to understand textbook exercise question regrading RSA

I am preparing for the final exam in my Data Security class so I am trying to read and understand the textbook's exercise questions. Any hint would be great. Question (Exercise 9.14 of textbook): ...
1
vote
1answer
50 views

Trying to udnerstand textbook sample solution

I am preparing for the final exam in my Data Security class so I am trying to read and understand the textbook's exercise questions. The sample solution at the end the textbook is more like a hint ...
1
vote
1answer
77 views

SHA256(RsaPrivateKey) == AES key?

I have an RSA private key (more specifically, an SSH key in Putty format, 4096bit) and want to use its SHA256 hash as an AES256 key, instead of using an independent newly generated AES key. Are ...
5
votes
2answers
236 views

Trapdoor and RSA (Schneier)

Disclaimer: I'm new to cryptography. Background: From Applied Cryptography (Bruce Schneier), page 30 of 2nd edition A trapdoor one-way function is a special type of one-way function, one with a ...
2
votes
0answers
23 views

Are the prime numbers used for RSA encryption known? [duplicate]

I read that one reason why RSA is secure is because it uses a huge number that's called the modulus which is the product of two prime numbers. For maths reasons the prime numbers being prime numbers ...
0
votes
2answers
59 views

Stripping off message authentication or signature

If attackers can strip off RSA / EC / -DSA digital signature and conduct CCA on AES-CTR or CBC payload, why can't they do the same for AES-GCM?
0
votes
2answers
43 views

Is ssl_sign safe as it is using OPENSSL_PKCS1_PADDING

I've been hearing a lot of scare talk about PKCS1 padding attacks. Is PKCS1 v1.5 safe in signatures as it is practically transporting only message digest? I'm using it in one of my applications so i'...
5
votes
1answer
71 views

Can RSA-PSS signing be made deterministic without loss of security?

Is it possible to make RSA-PSS signing deterministic without loss of security? Specifically, I would use Blake2b of the key and message to generate the salt.
0
votes
0answers
27 views

Weaknesses of RSA for $e_A\neq e_B: \gcd(e_A,e_B)=1$ [duplicate]

If two people, A and B, are using a common RSA modulus N, and they select distinct exponents $e_A$ and $e_B$, such that they are coprime, why does this mean that someone can decrypt (in polynomial ...
0
votes
1answer
72 views

Inverting RSA using an oracle

Say you are given an efficient deterministic algorithm 'I' that can invert the RSA function on 1% of the points in $Z^*_{N}$. That is to say that if y $ \in $ $Z^*_{N}$ is a "good" point for 'I', then ...
0
votes
0answers
40 views

How common are non-RSA digital certificates?

Is there a statistic available that shows just how common are DSA or ECC certificates amongst webservers? I know that RSA-based certificates are the most common, however I'd like to know, if there is ...