an asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption.

learn more… | top users | synonyms

4
votes
3answers
3k views

Is it safer to encrypt twice with RSA?

I wonder if it's safer to encrypt a plain text with RSA twice than it is to encrypt it just once. It should make a big difference if you assume that the two private keys are different, and that the ...
4
votes
1answer
94 views

Exposed raw RSA private key operation

Assume that there is a smartcard or other hardware token that exposes the raw RSA private key operation (modular exponentiation, with or without CRT parameters). Is there any possibility that raw RSA ...
3
votes
1answer
74 views

Is RSA encryption without padding secure with NIST Key Establishment schemes?

NIST SP800-56B standard (addressing IFC-based Key Establishment schemes) defines some key establishment (KE) schemes using the RSASVE primitive in which the common secret $Z$ is encrypted with RSA-EP ...
1
vote
1answer
19 views

Will changing the RSA Padding in OpenSSL cause issues?

I'm currently looking at changing the padding type from one of the Oracle Padding attacks to a secure one. Would this break data already encrypted using the old method?
5
votes
2answers
105 views

Signing MD5 hashes with RSA? [duplicate]

Lets say I need to update a project and allow anyone to distribute the updates, however I need it to be secure, so I hash the data and sign the hash, this project uses MD5. How likely would it be ...
0
votes
0answers
41 views

Encoding issue - PKCS#11 CKM_RSA_PKCS wrapping unwrapping EME-PKCS1-v1_5

I am trying to figure out why I am not able to get compatible format of EME-PKCS1-v1_5 3DES key encrypted by public RSA key. I need to send to a third party 3DES key encrypted using their public RSA ...
3
votes
2answers
305 views

RSA: Recover e given factorization of N and plaintext/ciphertext pair

Is there a way to recover the public exponent e (assume in this case it is in fact not public) used in an encryption if I know the following: Factorization of ...
0
votes
2answers
116 views

Algebraic structures in RSA

Why do we need a field for RSA and what are the two operations in this field? Why can't we have a ring or group for example? Because in a group you also have inverse elements.
3
votes
1answer
102 views

Anonymity problem after voting with blind signatures

In a distributed voting system (all the messages are public, but signed and maybe encrypted/blinded), having: $d$, $e$, $N$ — registrar key params $m$ — msg $r$ — random blinding factor $m'$ ...
3
votes
2answers
203 views

Finding Private key in RSA with public key, cipher text and plain text

Is there a known 'non-brute force' method of determining a private key in an RSA system when all other parameters are know? I found the values of a ciphertext ($C$), its corresponding plaintext ($P$) ...
-1
votes
1answer
46 views

What's the best way to pad a message?

Currently my padding is adding a string of random characters $ l(N)/3 - (l(M) + 1) $ Long and just adding it to the messages, is this sufficient? $l(x)$ = length of a variable
-1
votes
2answers
53 views

Finding d given everything else in RSA [duplicate]

I've got everything else (e, p, q, phi(n), n), but cannot see a way to figure out what d should be. P and q are both 300 digits, so phi(n) and n are about 600 digits, but e is only 5 digits. I do ...
0
votes
1answer
50 views

Proper forward secrecy [closed]

Currently I have a protocol using a simple RSA to AES handshake. I have been reading more and more and would like to implement proper forward secrecy, but at the same time I'd like to improve the ...
3
votes
1answer
52 views

Selective and existential unforgability of signature schemes

I understand that one can define EUF-CMA of a signature scheme is terms of a game where the adversary is allowed to query signatures on messages of his choosing, and at the end of the game he must ...
7
votes
2answers
413 views

Given enough RSA ciphertext, is it possible to determine which key was used?

Given enough RSA ciphertext, is it possible to determine which public key was used to generate the ciphertext? Presume an unknown public key that was used to generate RSA ciphertext, and we have ...
3
votes
1answer
147 views

Symmetric encryption using RSA for random generated password

I'm fairly new to encryption, so I wanted to check the logic for a .net solution I'm working on that encrypts data between two parties. the receiving (decrypting) party will have an RSA key pair ...
2
votes
0answers
106 views

RSA_DH vs ECDH implementation

In ECDH protocol is possible, naturally, to use the same algorithm for calculate a secret key for both communication parties (Alice and Bob for example). It is possible to design also a same algorithm ...
3
votes
1answer
2k views

Demonstrating the insecurity of an RSA signature encoding scheme

I'm working on problem 12.4 from Katz-Lindell. The problem is as follows: Given a public encoding function $\newcommand{\enc}{\operatorname{enc}}\enc$ and a textbook RSA signature scheme where ...
1
vote
0answers
72 views

“Prime conspiracy”'s effect on cryptography [duplicate]

Recent news reported about the discovery of a "Prime Conspiracy" which can be read about here. In summary, researchers have discovered that the last digit of prime numbers have a greater ...
2
votes
1answer
89 views

Is there an asymmetric algorithm that can perform double encryption?

I'm looking for any asymmetric algorithm can perform the serial encryption, by serial I mean double or more encryption with different key(same key size). RSA can not do it since the cipher of the ...
3
votes
1answer
127 views

How do I attack an RSA setup where e is even?

As a challenge, we were shown an RSA setup where we have a big $n$ (617 decimal digits), $e=4$, and asked to recover three messages. (However, the messages are padded to the same length as the key ...
3
votes
2answers
138 views

Why do we need Euler's totient function $\varphi(N)$ in RSA?

After we calculated $N = p * q$, we calculate $\varphi(N)$ and use it later to determine $e$ (PR) and $d$ (PU). But why? For decryption and encryption we only use $N$ and don't need $\varphi(N)$. So ...
1
vote
1answer
151 views

Cracking simple RSA when just the ciphertext and one public key is known

Can someone explain to me (Or better yet, point me to a tool that does the brute forcing) how to crack a standard, simple RSA cipher (So don't bother with padding) if I know just one public key, the ...
4
votes
2answers
317 views

Using Lattice-based cryptography for TLS\SSL

Given the general benefits of Lattice-based cryptography, such as: Post quantum Security Security from worst case scenario Efficiency What could the outlook of shifting from RSA \ ECC-based ...
8
votes
1answer
404 views

Given enough RSA signature values, is it possible to determine the public key value?

Given enough RSA signature values, is it possible to determine which public key is required to verify the values? Could there be enough information to establish which key is required? Is there ...
3
votes
1answer
119 views

Public key exponent coprime with totient proof

I read this question a while back (In RSA, why is it important choosing e so that it is coprime to φ(n)?). I was wondering whether there is a proof that shows that a public key exponent e that is ...
3
votes
1answer
39 views

how is the rsa $publickey(n ,e)$ transformed into a textfile allowing its public distribtution?

wikipedia says about the keys itself: The public key consists of the modulus n and the public (or encryption) exponent e. The private key consists of the modulus n and the private (or ...
1
vote
0answers
56 views

Encryption & decryption of integers using modular multiplicative inverse and extended euclidean algorithm

I'm looking for a neat algorithm, which is capable of encrypting an integer to another integer and decrypting it again AND is secure. When I was in university, my professor showed me an awesome way ...
0
votes
1answer
169 views

Cube-Root attack - RSA with low exponent

I have this RSA public key ...
2
votes
2answers
101 views

Implementing RSA with small integers in CUDA

I have found some researches dedicated for speeding-up RSA calculations using CUDA. But I am wondering how they do that, given that the biggest unsigned int that could be declared in CUDA is 64 bit. ...
4
votes
1answer
33 views

Is it okay to use a variable-time RSA implementation to verify TLS certificates?

RSA as implemented by OpenSSL et al. needs to protect against side channel attacks, at a big performance penalty. However, TLS certificate validation involves no secrets. Therefore, I should be able ...
-3
votes
1answer
51 views

How does the math part of RSA work? [duplicate]

I understand the theoretical part of RSA (the concept of public and private keys), but I don't understand the mathematical part. Can anyone please explain it to me in simple terms? Thanks.
0
votes
1answer
50 views

Is sharing the RSA public key secure?

I am trying to understand how RSA public key cryptography works. I have the following questions: Are any attacks / compromises possible if a server sends its public key $(n,e)$ in the clear to a ...
1
vote
1answer
88 views

Really simple RSA style public private key generator

I am giving a talk to high school students and would love to do a real life encryption/decryption demonstration. I am not too familiar with the maths but is it possible to create like a 5-10 bit ...
3
votes
0answers
71 views

How common are weak RSA keys?

There exist certain attacks that can be used against RSA keys whose prime factors are of specific forms, such as one by Coppersmith. How common are these RSA keys? If you generate primes randomly, ...
1
vote
1answer
90 views

What is the importance of 1 < d < φ(n) and 0 ≤ m < n in RSA?

I'm a first year Maths undergraduate and we have recently gone onto RSA. I understand the majority of the algorithm using Fermat's Theorem etc. From the algorithm stated on Wikipedia: 4) Choose ...
1
vote
2answers
758 views

Use cases and implementations of RSA CRT

I discovered the chinese remainder theorem (CRT) version of RSA cryptosystem which is used in many crypto libraries (OpenSSL, Java...). The use of this theorem improves the speed of decryption so, ...
14
votes
1answer
4k views

Assuming a 1024qb quantum computer, how long to brute force 1024bit RSA, 256bit AES and 512bit SHA512

Assuming in the future there was a functioning 1024 qubit quantum supercomputer and it could run Shor's algorithm or Grover's algorithm to crack encryption very quickly. I'm interested in how the ...
0
votes
3answers
133 views

Does RSA have two trapdoors?

I watched some videos from Khan Academy explaining the algorithm for RSA encryption/decryption. They explained that there are two trapdoors, modular exponentiation being one and prime factorization ...
3
votes
1answer
126 views

Relationship between exponent and modulus in RSA (as RSA properties as listed in X.509)

In one of my assignments, I had the following question (Please read on. Not a homework assignment :) ): X.509 (1998 version) lists properties that RSA keys must satisfy to be secure. One such ...
0
votes
2answers
100 views

RSA algorithm private key extraction

Decrypting messages can be done by using the following formula: $$M = C^d \mod n$$ Where $M$ is the decrypted message, $C$ is the encrypted message and $d$ is the private key Theoretically ...
3
votes
2answers
277 views

Is there any reason to use RSA or DSA when we have ECC?

I am having trouble coming up with a use case for RSA or DSA. It appears that ECC is better in every way. Is this true? I am looking for cases where RSA/DSA is superior to ECC, not where it is used ...
4
votes
1answer
113 views

How to attack RSA-CRT with large public exponent?

Suppose we have $(n,e)$ and the ciphertext $c$ where the public exponent $e$ is of the same length, 1023-bit, as the modulus $n$. It is also assumed that the factors of $n$ are balanced. The message ...
2
votes
1answer
147 views

Help understanding basic Franklin-Reiter related message attack

I am trying to understand this attack at the most basic level. I set up the following basic scenario: Let the public encryption exponent, e = 3. Let p, be some arbitrary but known (to the ...
0
votes
1answer
74 views

How to decrypt RSA if ciphertext is less than the modulus and e=3?

I'm given a public key. Using openssl rsa ..... I got the public key has the exponent as 3. When I calculated the size of the ciphertext, it is 8 bits smaller than the 2048-bit modulus. How can I ...
0
votes
0answers
24 views

Is RSA safe anymore? [duplicate]

Some people may have heard of Shor's algorithm. It allows for integer factorization on a quantum computer. This wasn't a problem a little while ago since we didn't have any quantum computers. Google ...
0
votes
1answer
37 views

Key sizes for RSA over elliptic curves

I know that it is possible to define RSA over elliptic curves just as DSA and Diffie-Hellman have been. I know that it doesn't offer much of a speed advantage, but does it at least reduce the size of ...
1
vote
1answer
85 views

Can RSA with padding detect all errors in ciphertext?

I'm new in cryptography and there are a couple of things that i'm not sure if i understand correctly. First, when using padding (PKCS or OAEP), if the chiphertext has errors in transmission we'll we ...
3
votes
2answers
114 views

Can RSA (theoretically) be used as a block cipher?

Assume AES gets a devastating attack making it unusable. Is it possible to use RSA in a secure way that can encrypt data in bulk? I can't see how RSA (assuming OAEP padding) can be used in normal ...
4
votes
3answers
90 views

Choosing which is public vs private key

When I calculate two RSA keys, what if anything, would make any difference which I call the public vs which I call the private key?