an asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption.
3
votes
1answer
137 views
Secure encrypt-then-sign with RSA
I understand that when you want to encrypt and sign data with RSA the generally recommended approach is sign-then-encrypt.
However, I have encrypted data that I need to sign, to prove the author of ...
3
votes
1answer
124 views
Safely use CryptSignAndEncryptMessage?
I am developing an application that sends messages which I want to encrypt and sign. The CryptoApi offers a function called CryptSignAndEncryptMessage.
The description says, what this function ...
3
votes
1answer
501 views
Common Modulus Attack in a Lucas Group
I'm trying to decrypt a message that is encrypted using a LUC encryption scheme and running into roadblocks. I know that with RSA if Alice and Bob use the same public modulus but different encryption ...
2
votes
2answers
118 views
Is it safe to use RSA as a proof-of-work system?
Suppose I devised the following challenge-response proof-of-work system:
A server generates a 2048-bit RSA modulus, and uses the "public" exponent (usually 65537) to sign a random nonce a fixed ...
2
votes
2answers
151 views
Why are RSA key sizes almost always a power of two?
I know that other bit sizes are possible, e.g. this HTTPS server seems to have a 9000 bit key https://www.ssllabs.com/ssltest/analyze.html?d=qqq.gg, but it's very rare that one sees a key not of size ...
2
votes
4answers
862 views
Why is padding used for RSA encryption given that it is not a block cipher?
In AES we use some padded bytes at end of message to fit 128/256
byte blocks. But as RSA is not a block cipher why is padding used?
Can the message size be any byte length (is the encrypting agent
...
2
votes
2answers
949 views
How much computing resource is required to brute-force RSA?
It's been over 30 years since Rivest, Shamir and Adleman first publicly described their algorithm for public-key cryptography; and the intelligence community is thought to have known about it for ...
2
votes
1answer
291 views
How many RSA keys before a collision?
I was wondering how many possibilities of private/public keys there are? If a million people for whatever reason tried to generate 5keys each in the same minute (on the same date and time) is there a ...
2
votes
2answers
492 views
Why should the RSA private exponent have the same size as the modulus?
Consider the generation of an RSA key pair with a given modulus size $n$ and a known, small public exponent $e$ (typically $e = 3$ or $e = 65537$). A common method is to generate two random primes ...
2
votes
2answers
117 views
Does a high exponent compensate for a low degree of certainty?
If a RSA certificate is created with a low degree of certainty, does the value of the exponent compensate for this?
I'm asking because certain implementations of key generation software hide the ...
2
votes
1answer
257 views
What happens if an RSA key pair has identical public and private exponents?
Rather, is it possible for big prime numbers?
Classroom examples usually involve smaller primes, so for example if you are given a prime number pair $p = 3$, $q = 13$ you would get $n = 39$ and $e = ...
2
votes
2answers
122 views
phi(P*Q) = (P-1) * (Q-1)
I was trying to understand RSA when I encountered the Euler Function. I do understand this: $\phi(P)$, where $P$ is a prime is $P-1$.
However it seems that for a number $N$ such at $N=P\cdot Q$ where ...
2
votes
2answers
422 views
Is RSASSA-PKCS1-v1_5 a good signature scheme for new systems?
Is RSASSA-PKCS1-v1_5 a good signature scheme to recommend that people use in new systems? Is it believed to be secure and represent the state-of-the-art in RSA-based signatures?
I understand that ...
2
votes
2answers
198 views
How to decrypt this RSA-like cipher
Suppose we have a RSA-type Modulus $n = pq$ with $p,q$ prime. We also pick a random public exponent $e$ with $\gcd(e,\varphi(n)) = 1$ and compute the private exponent $d$ with $de \equiv 1 ...
2
votes
1answer
186 views
Low Public Exponent Attack for RSA
I'm having trouble understanding the algorithm for finding the original message $m$, when there is a small public exponent. Here is the example I'm trying to follow (you can also read it in the 'Low ...
2
votes
1answer
106 views
RSA Key generation Public exponent too big
I'm currently writing a paper about RSA (a self-chosen subject).
I'm writing about the key-generation in RSA, and I have problem finding the public exponent e.
I have chosen p = 61 and q = 53.
Then ...
2
votes
2answers
190 views
Is RSA in a ECB-like-mode safe for bulk encryption?
Let's say I would like to communicate with my friend using asymmetric/public-key encryption, e.g. RSA.
(Note: I do realize that in practice this is done through an intermediate symmetric key, but ...
2
votes
1answer
427 views
How to sign a message using RSA?
Assuming I already have a D, P, Q, etc of an RSA key: How do I now sign a message? If it matters – the message is around 100 bits.
I don't know much about cryptography, but I can get these numbers ...
2
votes
1answer
77 views
How does OAEP improve the security of RSA?
The heart of OAEP algorithm used for RSA encryption are the cryptographic hash functions $H$ and $G$.
Does everybody (so also an adversary) know these functions?
If YES: How does it help the ...
2
votes
1answer
253 views
Is a known plaintext, ciphertext, and public-key a viable attack on RSA?
Assume Alice and Bob are using RSA to create a common session key and Cindy is listening, attempting to obtain the session key.
Alice and Bob each have their public- and private-key pairs ...
2
votes
1answer
154 views
What is the strength of unpadded RSA?
I would like to use unpadded RSA for homomorphic encryption in a toy P2P game, for things like fair coin flips and shuffling.
How many bits of security does unpadded RSA have, in relation to its key ...
2
votes
2answers
2k views
How does a chosen plaintext attack on RSA work?
How can one run a chosen plaintext attack on RSA?
If I can send some plaintexts and get the ciphertexts, how can I find a relation between them which helps me to crack another ciphertext?
2
votes
1answer
366 views
What does SSL use? RSA? El-Gamal? Elliptic curves?
I'm not sure what SSL uses to share the symmetric key to both end users, i.e. at the beginning of the communication. Is it RSA? Or El-Gamal? Or something else?
Thanks!
2
votes
4answers
193 views
Tamper-proofing log files
Problem Overview
I want to securely store log files so the contents are secret, and they can't be modified without detection.
The files will be encrypted using authenticated encryption (AES in GCM ...
2
votes
2answers
127 views
Chain several RSA encryptions without increasing the message size
I would like to be able to encrypt the output of RSA with RSA again without having the output grow in size over time.
In other words, I have some data $D_0$ which I want to encrypt with RSA: $D_1 = ...
2
votes
1answer
102 views
Are RSA signatures deterministic?
If I sign the word HELLO with the mechanism "NONEwithRSA" with the same private key, do I always will have the same signature?
A Java example always return ...
2
votes
1answer
107 views
Why is RSA usually limited to messages up to 1 block
I'm wondering why RSA encryption usually is only used for messages that fit into one block.
For larger messages hybrid encryption in combination with symmetric ciphers like AES seem to be the solution ...
2
votes
1answer
98 views
RSA Without Padding?
I've been looking at the weakness with plain/textbook RSA, where the same message is encrypted and sent to multiple destinations. In this case, it is possible to recover the message.
Given that an ...
2
votes
3answers
594 views
Is it safer to encrypt twice with RSA?
I wonder if it's safer to encrypt a plain text with RSA twice than it is to encrypt it just once. It should make a big difference if you assume that the two private keys are different, and that the ...
2
votes
1answer
136 views
Why do we need in RSA the modulus to be product of 2 primes?
I think I roughly understand how the RSA alorithm is working.
However, I don't understand why we need the $N$, which we use as a modulus, to be $pq$ for some large primes $p, q$.
I vaguely know it ...
2
votes
1answer
409 views
Is RSA of a random nonce with no padding safe?
Consider the following protocol: Bob has a private RSA key $B_{priv}$, and Alice knows the public key $B_{pub}$. Alice wants to send confidential messages to Bob (no integrity intended). To send a ...
2
votes
2answers
266 views
Is it possible to figure out the public key from encrypted text?
Suppose Alice sends messages to Bob by encrypting the messages with Bob's public key.
Eve knows that the data is encrypted using RSA, but does not know the public key. Can Eve figure out the public ...
2
votes
1answer
528 views
RSA cracking: The same message is sent to two different people problem
Suppose we have two people: Smith and Jones.
Smith public key is e=9, n=179 and Jones public key is e=13, n=179.
Bob sends to ...
2
votes
1answer
177 views
Extract private RSA key from USB cryptographic token using Bardou et al. attack (varian of “million message attack”)
There is a side channel attack on tamper-resistant USB cryptographic tokens using padding-oracle, described by Bardou, Focardi, Kawamoto, Simionato, Steel and Tsay, titled "Efficient padding oracle ...
2
votes
2answers
339 views
Homomorphic cryptosystems in RSA
Hopefully Crypto can help me understand homomorphic cryptosystems.
I'm designing a high score server for a game I made, and because of facets in the language i'm using, the player would be able to ...
2
votes
1answer
268 views
What is the harm if I publish an encrypted RSA private key publicly?
What is the harm if I publish an encrypted RSA private key publicly? Or in this case, what is the harm if I publish many thousands or millions of them?
Assuming that the private key is encrypted ...
2
votes
1answer
111 views
Signing a GCM MAC
If I encrypt a message with AES-GCM, is it safe to use the MAC as the hash in a DSA/RSA signature? That is, if someone knows the AES key and nonce, will they be able to generate a different message ...
2
votes
2answers
134 views
How can mega store my login details and still be secure?
I understand how Mega's encryption works. For a quick summary of all those in the future looking for an answer on this... here is how it works:
Upon first signing up for an account you make a ...
2
votes
1answer
75 views
Individual bits of Textbook RSA
This question relates to the underlying RSA assumption. Forgetting about the fact that Textbook RSA is deterministic, I am curious about the assumed strength of the RSA problem.
Does RSA hide all ...
2
votes
1answer
227 views
How much extra information is in an RSA public key?
I'm trying to calculate the size of an RSA public key in Ruby. I've retrieved the key in PEM format, and once I've decoded the base64 part from the PEM format, I get the size in bytes. What I find is ...
2
votes
2answers
136 views
Is there a way to compare the 923 bit pairing based key with RSA or AES, etc
I've see many articles, most of them basically the same, praising Fujitsu for cracking what is referred to as a 923 bit pairing based encryption. I understand that in comparing RSA to AES you've got ...
2
votes
2answers
415 views
Proof of security for RSA signatures
I am new to here, I was having some problems with a problem I am working on:
"For each of the following variants of the definition of security for signatures, state whether textbook RSA is secure ...
2
votes
1answer
387 views
Demonstrating the insecurity of an RSA signature encoding scheme
I'm working on problem 12.4 from Katz-Lindell. The problem is as follows:
Given a public encoding function $\newcommand{\enc}{\operatorname{enc}}\enc$ and
a textbook RSA signature scheme where ...
2
votes
1answer
92 views
is it possible to spoof an identity cert modulus
I was looking at foaf+ssl http://www.w3.org/wiki/Foaf+ssl and wondering if its possible to spoof the modulus of the browser cert so that the foaf and browser cert modulus match
2
votes
2answers
210 views
RSA private key format for Mega
I've been trying to reverse engineer Mega's (mega.co.nz) API calls. And stopped on the step where client needs to decrypt session id with provided RSA key. I can get key data, but I have no idea how ...
2
votes
1answer
125 views
RSA-OAEP versus RSA with Fujisaki-Okamoto construction
I was wondering why the Fujisaki-Okamoto construction (or one of its variants) is not (at least commonly) used with RSA to achieve CCA2 security? Does anyone know of any speed comparisons between RSA ...
2
votes
2answers
504 views
Using an RSA private key simultanously as an AES encryption key to generate random numbers?
Currently I'm implementing a PRNG for an embedded system. Using the RFC 4086 I've decided to use the X9.17 - to be more specific the succesor X9.31- standard to implement my PRNG. X9.17 uses DES, but ...
2
votes
0answers
100 views
Ring Signature - paper/code difference in trying to solve inverse trap door function?
there is a paper on ring signatures and a python implementation of it here.
The Step 4 in the paper describes $y_s = v =C_k,_v(y_1, y_2, ... y_r)$ for all $1 \leq i \leq r$ where $i \neq s$. The ...
2
votes
0answers
112 views
RSA reencryption scheme
Is there such an algorithm that would allow to upgrade the encryption of a RSA-encrypted message without revealing the plaintext to the untrusted user?
Basically, such an algorithm would probably be ...
2
votes
1answer
227 views
Attacks on the RSA Cryptosystem
I was reading some articles about attacks on RSA system and I wonder about some generalization of the following theorem.
Theorem (Coppersmith).
Let $N=pq$ be an $n$-bit RSA modulus, where
...
