an asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption.

learn more… | top users | synonyms

13
votes
8answers
2k views

RSA with small exponents?

Just to establish notation with respect to the RSA protocol, let $n = pq$ be the product of two large primes and let $e$ and $d$ be the public and private exponents, respectively ($e$ is the inverse ...
3
votes
0answers
101 views

How much plainext could be known without reducting security of RSA?

It is known, for example, that exposing 50% of most significant bits of RSA private exponent does not provide security risk (when a small public exponent it used). So how to qualify security ...
4
votes
2answers
995 views

Are there any standards of multi-prime RSA key generation?

FIPS 186-3 specifies a method to generate DSA parameters. Is there anything similar (official standard or widely-accepted recommendation) that shows how to generate the primes for multi-prime RSA?
3
votes
1answer
264 views

RSA with modulus product of many primes

I would like to ask what happens if we build an RSA system with modulus a product of more than 2 primes, for example let $n=p_{1}p_{2}...p_{L}$. I know only the classical RSA system with $n=pq$ with ...
9
votes
0answers
299 views

Who first published the interest of more than two prime factors in RSA?

Multi-prime RSA is now a well known technique: it uses $k>2$ distinct secret prime factors in the public RSA modulus, with the advantage that, using the CRT, we can gain a speed boost in ...
2
votes
1answer
93 views

Secrete message sharing using N private keys

I'm looking for an encryption scheme that could possibly meet the following requirements. Let, $X = plaintext$ $M = (pub, priv)$, where $priv == (Ky + Kz)$ Given ...
1
vote
1answer
70 views

Necessity of changing $p$ and $q$ when your private key is exposed?

Suppose your private key $d_1$ has been exposed. Instead of changing $p$ and $q$, instead you just choose a new public and private key (say $e_2$ and $d_2$) and use these instead. What kinds of ...
7
votes
3answers
2k views

Why hash or salt when signing?

I've seen an example of how to sign using RSA. Besides the signing itself (s = m^d mod n) it also hashes and adds an IV. Why is that needed?
0
votes
0answers
55 views

Plaintext patterns leaked based on single bit

Assuming that Elgamal is used as an encryption cipher, where lets say $p$ is 2048bit prime. Is it possible for an attacker to figure out $x$, a secret key, if any part of 2048 bits ciphertext and ...
2
votes
2answers
153 views

RSA: What happens to restrictions of plaintext n, dependent on p and q?

Ok - i will try to ask my question as clear as possible. Im getting a little deeper into the RSA-cryptosystem. At one point i'm a little confused. We have a plaintext $x$ and ciphertext $y$, with $x ...
11
votes
6answers
5k views

Is Diffie-Hellman mathematically the same as RSA?

Is the Diffie-Hellman key exchange the same as RSA? Diffie Hellman allows key exchange on a observed wire – but so can RSA. Alice and Bob want to exchange a key – Big brother is watching everything. ...
1
vote
1answer
187 views

Certificate signature with SHA-1 and RSA: where do 1888 bits come from?

Plenty of X.509 Certificates use "PKCS#1 SHA1 with RSA encryption" as the Certificate Signature Algorithm for generating a 2048-bit signature. The SHA-1 hash function generates a hash value of 160 ...
1
vote
2answers
206 views

How can I simulate and measure brute force hacking using RSA?

I want to implement brute force hacking using RSA. How can I simulate and measure time duration? What software (or software-based simulator) would be needed?
5
votes
5answers
463 views

Is there a technique to confirm that a given large integer value is a product of two primes?

Given a list of 2048 bit integer values in which one or few 2048 bit integer values may be product of two prime numbers and other values may be just 2048 bit odd integers numbers. My question is - ...
1
vote
1answer
169 views

Short length asymmetric encryption?

I want to send out short messages to the world which listeners could verify to be send from me. The way this is usually done is to encrypt the message with a private key where the readers decrypt it ...
1
vote
2answers
312 views

Securely send public key from client to server in RSA?

I have a client and a server communicating with messages encrypted using RSA. Initially, the client knows server's public key, but the server does not know the client's public key. Is it possible to ...
6
votes
3answers
538 views

Initialize a PRNG with a password

Let's assume that we have a secure PRNG. Is it "safe" to initialize it with password, or seed based on a password like SHA256(password)? If yes, is it "safe" to generate an RSA or DSA key from it? ...
0
votes
2answers
142 views

Encryption of a number with RSA bigger than $n$

I'm having trouble understanding why encrypting a number $m$, which is larger than $n=p\cdot q$. I've looked into the following threads: Why RSA can't handle numbers above 76? Why does plain RSA ...
1
vote
2answers
94 views

Proof for exponentiation in modular arithemtic

If $e$ is a natural number, then this is true: $$m^e \bmod\ n = (m\bmod\ n)^e\bmod\ n$$ This is often used when encrypting, especially with RSA, since one can avoid directly calculating $m^e$, ...
2
votes
1answer
303 views

Why can ECC key sizes be smaller than RSA keys for similar security?

I understand how ECC is based on the discrete log problem and RSA on integer factorization. I've read several references that show how a solution to either of these problems can typically be adapted ...
1
vote
1answer
106 views

Usage of Fermat primes in RSA

Why are Fermat primes ($2^{2^n}+1$) useful as $e$ (the public key) in RSA encryption? I understand why $2^n+1$ primes are useful, because they would simply be ...
3
votes
2answers
205 views

Avoiding overflow when encrypting with RSA

When encrypting with RSA one calculates $ m^e \pmod n $ by doing the following: m^e % n Where $m$ is what we encrypt. Often $e$ is a very big number to make it ...
1
vote
1answer
84 views

Method to calculating e in RSA

For simplicity I choose two small primes for p and q. p=3 q=11 n=33 Φ(n)=20 Now we need ...
0
votes
1answer
47 views

Digital Signature with Encryption

Hope it will be clear. I need to digitally sign pieces of information. What I'm currently doing is the following (for each piece of information): Run SHA1 on the information Encrypt the result with ...
5
votes
1answer
204 views

What does “Inverting the RSA function is as hard as factoring” mean (a rigorous explanation or intuitive will do)?

I was reading that a current open problem is if inverting the RSA function is as hard as factoring. Does this mean that, its an open problem whether, if given a subroutine that computes in ...
-2
votes
3answers
787 views

How can I find the prime numbers used in RSA?

I got this question in a local hacking event, but I couldn't solve it. Problem Statement ---- Continuing their snooping habit, NSA kept bugging Alice's communication. Resorting to the age old ...
10
votes
3answers
915 views

Are any of the major asymmetric ciphers distinguishable (EG, RSA, ECC)?

Related to "Is it possible to derive the encryption method from encrypted text?". Given ciphertexts generated by any of the major asymmetric ciphers (RSA, ElGamal, ECC, etc..) can these ciphertexts ...
2
votes
1answer
133 views

Which platforms are most vulnerable to Simple Power Analyse Attack

In a "Simple Power Analyse Attack", the difference in power consumption during multiply or square operation is used. In the RSA decryption process with the "Square and Multiply" algorithm, both ...
5
votes
1answer
1k views

Low Public Exponent Attack for RSA

I'm having trouble understanding the algorithm for finding the original message $m$, when there is a small public exponent. Here is the example I'm trying to follow (you can also read it in the 'Low ...
5
votes
2answers
185 views

RSA cipher wrong use

Why is it foolish if you decide to use an RSA cipher to encode some message by first converting each letter of the message to an integer? So for exmaple Space=0, a=1, b=2,... After the conversion I ...
1
vote
1answer
593 views

What is the difference between SHA256WITHRSA and SHA256WITHRSAENCRYPTION digest algorithms?

I installed djigzo on my android phone and I want to use it for smime mail. I don't know the difference between choosing SHA256WITHRSA and ...
1
vote
0answers
92 views

Distributed integer factorization?

I'm looking around for publicly published work on factorization of large numbers using distributed systems of any kind. So far I've come across the PDF "Mapreduce for integer factorization" by Javier ...
10
votes
1answer
4k views

Calculating RSA private exponent when given public exponent and the modulus factors using extended euclid

When given $p = 5, q = 11, N = 55$ and $e = 17$, I'm trying to compute the RSA private key $d$. I can calculate $\varphi(N) = 40$, but my lecturer then says to use the extended Euclidean algorithm to ...
2
votes
3answers
174 views

EC equivalent for RSA-OAEP

I have some questions regarding aforementioned subject: Is there a EC equivalent of RSA-OAEP key transport/encryption algorithm ? Is ECIES-KEM sufficient ?
1
vote
2answers
204 views

Encrypt and decrypt data accessible by multiple users within a team

I'm currently working on web services which allows to send and retrieve data. The data belong to a team. A team is composed of users. Each authenticated user can send and retrieve data to/from their ...
0
votes
1answer
175 views

how do you calculate the private exponent in asymmetric key encryption [duplicate]

Here is an excellent paper on the math of asymmetric key encryption: http://www.mathaware.org/mam/06/Kaliski.pdf‎ See the example on Page 6. The public key = $55$ Primes used to calculate public ...
4
votes
4answers
410 views

Where does the $\varphi(n)$ part of RSA come from?

$e d \equiv 1 \pmod{\varphi(n)}$ Where does the $\varphi(n)$ part come from? How did the inventors of RSA arrive at $\varphi(n)$?
2
votes
1answer
153 views

RSA key length choice for TLS when confidentiality not important?

I've a couple of questions about this, the scenario is embedding a key pair in a hardware device which will speak with other hardware devices over tls. computing resources are an issue so i want to ...
1
vote
0answers
98 views

Can you show how that RSA does/doesn't provide anonymity?

Considering a CPA-secure version of RSA where the ciphertext is just a rundom element from $Z^*_N$. Does that meet the anonymity requirement in which an cpa adversary cannot distinguish between a ...
11
votes
4answers
2k views

Why RSA encryption key is based on modulo $\varphi(n)$ rather than modulo $n$

While calculating RSA encryption key we take modulo $\varphi(n)$ rather that modulo $n$. I couldn't understand why its so?
2
votes
1answer
161 views

Why encrypting with private and public keys produce the same result?

Let say $e = 5$, $n = 119$ and $d = 77$. If I encrypt, for example, $m=15$ I get: $$m_1 = m^e=15 ^ 5 \mod 119 = 36\qquad\text{and}\qquad m_2 =m^d= 15 ^ {77} \mod 119 = 36$$. Why? Is it always like ...
7
votes
2answers
401 views

How does Clifford Cocks 'Non-Secret Encryption' work?

I have read Clifford Cocks "A Note on 'Non-secret Encryption'" and thought I would try to implement this, but I don't seem to be able to get it to work. I'm obviously missing something. From the ...
2
votes
1answer
79 views

Usability of padding scheme in blinded RSA signature?

In Wikipedia's article on Blind signature, in the section Dangers of blind signing which describes RSA blinding attack one reads the following This attack works because in this blind signature ...
4
votes
1answer
321 views

Can you explain Bleichenbacher's CCA attack on PKCS#1 v1.5?

I've studied that the Bleichenbacher's CCA attack on PKCS#1 v1.5. is a base to many versions of attacks in the area. I'm trying to understand that attack, but every explanation I saw starts with the ...
5
votes
1answer
233 views

RSA exhibits symmetrical properties — is it possible to form a cryptanalytic attack?

This question is broken into two sections really: Symmetry in RSA I have been analyzing raw RSA and I have noticed some interesting symmetrical properties of the algorithm. Assume that $M$ is a ...
2
votes
2answers
2k views

RSA 4096 bit key benchmark

is there any benchmark for RSA 4096bit long keys on general computers ? how many encryption decryption possible per second ? all benchmarks only show 1024 and 2048 benchmarks :(
2
votes
1answer
168 views

Off-the-record communication

Is my protocol correct? For fun, I tried to design a protocol that would allow off-the-record communication. I'm not sure it works, I have a feeling there might be a problem with it that I'm not ...
3
votes
1answer
127 views

Security Level Estimate when Cascading/Compositing Ciphers?

Way back when, DES had a theoretical security level 56-bits. 2-key TDEA provides about 80-bits of security, and 3-key TDEA provides about 112-bits of security. Obviously, those security levels are not ...
6
votes
1answer
228 views

Blinding twice in RSA

I understand that if you have a message $m$, you can blind it by selecting a random $r$ and then multiplying $r^e\times m \pmod{n}$ Someone else then signs it with $d$, raising to the power of $d$: ...
3
votes
1answer
561 views

Good entropy source for generating openssl keys

I need to generate a CA (4096-bit RSA) and server keys for openvpn and I want them to be "top quality". Here is my plan: gather entropy from multiple sources (saving individual files): FreeBSD ...