an asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption.

learn more… | top users | synonyms

3
votes
1answer
87 views

How to understand RSA Proofs of correctness at Wikipedia

From Wikipedia(https://en.wikipedia.org/wiki/RSA_%28cryptosystem%29#Proofs_of_correctness): $m^{ed}$ ≡ $m$ $\pmod{q}$ $m^{ed}$ ≡ $m$ $\pmod{p}$ then $m^{ed}$ ≡ $m$ $\pmod{pq}$ Question: if $m^{ed}$ ...
4
votes
1answer
75 views

Adding two RSA private key

We've constructed a new private RSA key from two known private RSA keys $Priv_1$ and $Priv_2$ as follows: $$p = next\underline{}prime\left(\frac{Priv_1(p) + Priv_2(p)}{2}\right)$$ and $$q = ...
2
votes
0answers
81 views

Limit the number of private key uses for RSASSA-PKCS1-v1_5 with SHA-256 signature?

Assuming all messages and their signatures are available to the attacker, is it secure to use the same RSA private key to sign many messages (roughly $10^{6}$) via PKCS#11 ...
0
votes
0answers
16 views

In the RSA encryption system, are there not multiple messages m that give the same cipher text c? [duplicate]

For example: p = 5, q = 11, n = 55 $\phi$(55) = 40 e = 3, $\phi$(55) and 3 are relatively prime m = 3, then: $3^3 mod(55) = 27$ m = 113, then: $113^3 mod(55) = 27$ I heard that e and $\phi$(n) ...
3
votes
1answer
95 views

Distribution based integer factorization

The past week I've been looking into - and playing with - algorithms for factoring RSA moduli. From what I understand, it's important that the primes p and q are of the same magnitude as the square ...
6
votes
3answers
191 views

Is there an upper bound to the private exponent in RSA?

In the RSA algorithm, we choose $p$ and $q$ as prime numbers and we select a value $e$ which is coprime to $\varphi(pq)=(p-1)(q-1)$. Then we calculate $d:=e^{-1}\bmod\varphi(pq)$. My question is: ...
1
vote
1answer
152 views

How to determine the RSA Private key size from the Public.key file?

Question: How to determine the RSA Private key size from the Public.key file? Just roughly, how big it could be? ...
0
votes
1answer
117 views

1024 RSA Hash Signature attack. Forge a valid signature

I have an RSA signature of 1024 bit where i know the following: Public modulus N Public exponent (0x03) Cypher message Summary: An MD5 hash is calculated from a collection of byte and is used as ...
0
votes
1answer
42 views

How to deliver an encrypted message to multiple recipients without revealing keys

Let's say I have generated a private and a public key. I create a message and encrypt it with the public key. I deliver this encrypted message and a private key to multiple recipients. Why would I do ...
2
votes
1answer
57 views

Why can we ignore $y$ when using the extended Euclidean algorithm to calculate an RSA decryption exponent?

I have a follow-up question about the extended Euclidean algorithm, as applied to RSA key generation, described in this answer. Let us say we have $p=5$, $q=11$ and $e=17$, so that $N=55$ and ...
2
votes
2answers
437 views

Is it safe to reuse a symmetric key when using asymmetric encryption?

I've written a C# Library that I hope will be used for security purposes in a commercial application. The application will communicate through the internet and not on an internal network. I am using ...
3
votes
0answers
25 views

Authenticate encrypted seed for KEM + AEAD hybrid cryptosystem

Say I want to encrypt something using RSA / KEM and an authenticated cipher. I encrypt using the following scheme: generate random seed z using ...
2
votes
2answers
293 views

RSA: Is it secure to use the private key to encrypt and the public key to decrypt?

This may sound weird: What if I don't let others know my public key, then use my private key to encrypt, and the public key to decrypt? Is this secure? Let me explain a little bit: Common usuage: ...
1
vote
1answer
69 views

If my server utilises an RSA based certificate, why does firefox think I am using Diffie Hellman?

I am not a beginner in crypto, but not that far from it, so please be gentle. I look after a web server app that I generated the SSL certificate for, and I used an RSA public/private keypair. When ...
2
votes
1answer
99 views

Verify a RSA signature using only RSA encryption

I'm trying to verify a RSA signed message, however, the API that I have access to in that environment only has encrypt and decrypt. I think I understand that verification and encryption with public ...
2
votes
1answer
87 views

Is there really any way to nullify or avoid MITM attacks?

The question pretty much sums it up. Is there any way to make an attacker who is successfully performing an MITM attack to actually not be able to read or change the messages? Assuming there is no ...
5
votes
1answer
214 views

Using same modulus for RSA

I know that there exist some attack when using same modulus. Can two different pairs of RSA key have the same modulus? RSA cracking: The same message is sent to two different people problem But ...
1
vote
1answer
44 views

Authenticating with a document

Hope you're having a nice day. I need to implement an authentication system between a "document" (it's not exactly a document, but an object without any computing capacity, only able to store ...
3
votes
2answers
1k views

Generate RSA-2048 private key for a VERY fast decryption (don't care if it will be unsecure)

Given public standard RSA exponent e = 65537, is there any (d, n) pairs so that RSA decryption becomes a trivial operation? The modulus n must be no less than 2048-bit. The goal is to get a real ...
2
votes
1answer
115 views

RSA - PKCS#1 padding - overall correction of algorithm

From PKCS#1, page 24: After we create the EM byte string and convert it to an integer, we then encrypt that integer with RSAEP (page 10) to get the ciphertext (as an integer). My question arrives ...
1
vote
0answers
75 views

CPA-security proof of “l-padded RSA” encryption scheme

The 10.9 exercise from the Katz-Lindell textbook creates a lot of confusion, let me state it here. Consider the following experiment for an algorithm $A$ and a function $l$ with $l(n) \leq 2n-2$ for ...
8
votes
1answer
109 views

Can RSA be securely used for “blind decryption”?

Assume we have the following setup: A client with trusted storage and computing capabilities (e.g. a smartcard) A server with trusted computing and short-term storage capabilities (e.g. RAM + CPU, ...
3
votes
1answer
329 views

Recommended password complexity for SSH key encryption using AES-256-CBC

When protecting SSH private keys with password-based encryption, what would be a good minimum password complexity+length standard to make cracking the password too difficult to be worthwhile anytime ...
2
votes
1answer
112 views

Why isn't a table used to solve the large number factoring problem?

Lots of modern encryption (RSA comes to mind) are based on the fact that factoring large numbers is hard. However, multiplying large numbers is much easier, and table lookups are very easy. Since ...
8
votes
4answers
639 views

Is it possible to get an RSA encryption key by comparing the unencrypted and encrypted file?

Exactly what the title says. If I have a RSA encrypted file, and the exact same file but decrypted, can I tell the key that was used from that information?
5
votes
2answers
425 views

How to verify the integrity of RSA encrypted messages?

I need to encrypt messages using PublicKeyCrypto and send it to the server, where the message should be decrypted. I'm aware of the Padding Oracle Attack and want to apply a server side integrity ...
3
votes
1answer
80 views

Is RSA vulnerable to the padding oracle attack?

I know that AES in combination with CBC mode is vulnerable against the Padding Oracle Attack. RSA also uses some kind of padding, hence can this attack be apply to RSA encrypted messages too?
6
votes
1answer
304 views

What does “a 15360-bit RSA key is the equivalent to a 256-bit symmetric key” mean?

NIST key management guidelines suggest that 15360-bit RSA keys are equivalent in strength to 256-bit symmetric keys. If a 15360-bit RSA key is the equivalent to a 256-bit symmetric key, does that mean ...
2
votes
2answers
64 views

How badly does disclosing an M-bit prefix of an N-bit private key compromise security?

I apologize profusely for knowing nothing about cryptography, please go easy on me! I'm working on a project where I have a 2048-bit RSA private key and a public certificate generated from the ...
1
vote
1answer
68 views

Difference between RSA-617 and RSA-2048

according to wikipedia: RSA-617 has 617 decimal digits (2,048 bits). RSA-2048 has 617 decimal digits (2,048 bits). What is the main difference between them?
2
votes
1answer
119 views

Security impact of signing small data using RSA

I have an application which consists of a client and a server. Both have a pair of public and private key (RSA). For communication, both sign their messages and send them to the other part. So a ...
3
votes
0answers
41 views

IND-CCA1 RSA padding?

I've found a way to complete a task which I'd solve with passwords or by sending keys over the wire (otherwise) by using RSA's homomorphic property. I'm restricted to RSA (any padding; for hardware ...
1
vote
2answers
104 views

Modular Multiplicative Inverse and RSA?

In trying to understand this specific part of the RSA algorithm, I found this online... I understand by Euler's theorem, that $d^{\phi(n)}$ = 1 mod $n$ What I don't understand is the substitution ...
11
votes
2answers
172 views

Attacking RSA signature verification that ignores padding

I am looking at a RSA signature verification that is quite obviously flawed and am wondering if there's a way to exploit that flaw in practice. Signature is generated using RSA with PKCS 1.5 padding, ...
0
votes
2answers
130 views

How is message length involved in public/private-key encryption?

I've just read this question regarding why to sign only the hash of a message. I kind of understood the answer, but the question arisen is now: Why can I encrypt any text messages with the same ...
0
votes
1answer
65 views

RSA signature attack check on lowest 16 bytes - Implementation

I am referring to solution given in this question I need help to implement Poncho hint in this comment: As the first question i have an RSA signature of 1024 bit applied on an hash (MD5) of the ...
-3
votes
1answer
76 views

RSA problem - how to find $d$ [duplicate]

For example, let $p = 3$ and $q= 11$, choose $e = 3$. What computation I have to apply in order to find the corresponding $d$? I know it's 7, but I want to know the exact process to be applied to find ...
0
votes
0answers
41 views

RSA Encryption: What happens if n is a factor of the message M? [duplicate]

From what I have learned about RSA encryption, the message M and the modulo n must be coprime because Euler's theorem only holds for coprime numbers? for example, what happens if I choose p = 3, q = ...
0
votes
1answer
44 views

Key exchange resilience to DoS attack

I am designing a user registration protocol for a system where I control both clients and servers. The aim is to establish a symmetric key for subsequent authentication, while minimizing the work ...
2
votes
2answers
101 views

Present an attack for the combination of OTP and textbook RSA

Let $N=p \times q$ where $p$ and $q$ are two primes. Compute $\Phi (N) = (p-1)(q-1)$. Choose $e$ s.t. $1 < e < \Phi(N)$ and $gcd(e,\Phi(N))=1$. Compute $d = e^{-1}(mod \ \Phi(N))$. ...
1
vote
1answer
78 views

What is k in RSA?

I am currently learning about RSA since I didn't understand the public-key-system but now I am… kind of. So I am writing the numbers as follows: $p = prime\ number\\ q = prime\ number\\ N = ...
3
votes
1answer
154 views

Why don't use random padding in RSA?

Consider the following scenario: Sender S sends a message to receiver R. He uses a hybrid encryption scheme with RSA as key-encapsulation algorithm and AES-256-CTR (4byte-counter) and SHA256-HMAC. ...
0
votes
1answer
118 views

How many bits to flip in an RSA public key to do signature forgery?

Scenario: Alice wants to verify a signature from Bob. Alice knows Bob's RSA public key (e, n). However, Alice is getting the data, the signature of the data and the public key from an attacker Eve. ...
2
votes
1answer
568 views

Why should the primes used in RSA be distinct?

The two primes $p$ and $q$ part of the public key need to be distinct. What's the reason for them to be distinct? Is it because factorization of $p^2$ where $p$ is a prime is relatively easier, or is ...
2
votes
1answer
128 views

RSA signatures without padding

Suppose I have a message $M$ for which I generate an RSA-2048 digital signature as follows: $H = H(M)$, $H(M)$ being the SHA-256 of the message $M$ $S = H^d \bmod N$ Assume $N = pq$ is properly ...
0
votes
0answers
85 views

RSA-PSS salt size in certificate

In RFC 4055, the signature RSAPSS algorithm has the following ASN 1 parameters: ...
0
votes
1answer
17 views

PK systems using groups in practice

The four Public-key cryptosystems: RSA, ElGamel, DH, and Rabin (all with others) all require some group operations in an integer field or multiplication group of some residue classes. When it comes ...
1
vote
0answers
64 views

RSA algorithm assignment [duplicate]

Alice wants to share a symmetric key with Bob. She encrypts the small (64-bit) secret key $K$ with Bob’s public RSA key $(n,e)$ by padding it with zeroes to 2048 bits (the length of n) and computing ...
3
votes
1answer
65 views

RSA: Range of public modulus

I know the public modulus is the product of two primes. For key with length L, the public modulus N should be such ...
8
votes
1answer
819 views

If RSA is only used to encrypt symmetric keys which are random, what's wrong with textbook RSA?

IND-CPA is used to protect against frequency analysis AFAICT. But if RSA is only used to encrypt symmetric keys (AFAICT) then what's wrong with using only textbook RSA because random keys are very ...