an asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption.

learn more… | top users | synonyms

4
votes
1answer
180 views

When is an asymmetric scheme considered broken?

Does the following quote imply that valid encrypted data can be created and decrypted by someone other than the owner of a private key: An asymmetric encryption scheme is considered to be broken ...
4
votes
1answer
555 views

how to use common modulus attack?

I am struck with the following problem: Let Alice, Bob, Chris and Eve communicate over a public network. They encrypt all messages they send using RSA system. Bob and Chris have the RSA modulus ...
4
votes
1answer
320 views

Is knowing the private key of RSA equivalent to the factorization of $N$?

Given the RSA modulus $N$ the fastest method to factor it is of sub-exponent order. But, now if I know the private key $d$ of RSA, does that mean I can factor $N$ efficiently?. It intuitively seems ...
4
votes
1answer
208 views

Solve a Modular Exponentiation

It might be common, but if we had to solve an equation like this $m=s^{e}$ mod $n$ where $m,e,n$ are known. How can we find $s$. What optimisations could be applied? And what would the complexity of ...
4
votes
3answers
191 views

Why can an RSA signature be authenticated ONLY with the signer's public key?

I'm an undergraduate Math student currently taking a cryptology course. I have a question about the RSA signature authentication mechanism. An RSA signature can be authenticated with the public key ...
4
votes
1answer
1k views

RSA example-calculation: Public Key = Private Key (e = d)

I am a bit confused. I just calculated manually the single steps of RSA for an implementation with small numbers and suddenly $d$ was equal $e$. Please help me understand what I am doing wrong. ...
4
votes
1answer
156 views

Is the strength of RSA over quadratic or other cyclotomic fields as strong as over the integers?

If we assume the strength of RSA is based on the difficulty of factoring (which I know we can't guarantee) and we compose the modulus of some other quadratic ring that is a unique factorization domain ...
4
votes
1answer
267 views

Timing Attack on RSA

So far I have researched on timing attack on RSA, We all know the ransomware named Cryptolocker it uses RSA 2048 bit encryption. Now is it possible to break the encryption using timing attack. I have ...
4
votes
1answer
690 views

Recent attacks on RSA

At Blackhat 2013 this week, there was a talk saying RSA is (essentially) doomed in the near future. networkworld.com ~ “Black Hat: Elliptic curve cryptography coming as smarter algorithms threaten ...
4
votes
1answer
202 views

Why work in a subgroup QR(n) of an RSA group $Z^*_n$?

I sometimes read in papers that a (sub-)group generator $g$ is taken from $\mathrm{QR}(n)$ instead of $\mathbb{Z}^*_n$, where $n = p \cdot q$ and $p$ and $q$ are prime. Is there a reason for this? ...
4
votes
2answers
597 views

Attacks on the RSA Cryptosystem

I was reading some articles about attacks on RSA system and I wonder about some generalization of the following theorem. Theorem (Coppersmith). Let $N=pq$ be an $n$-bit RSA modulus, where ...
4
votes
1answer
3k views

Constructing RSA private key, given public key

As part of a puzzle I was given an RSA 256-bit public key and an encrypted message. The key itself is very weak, having exponent e = 65537 and modulus N = ...
4
votes
2answers
1k views

Homomorphic cryptosystems in RSA

Hopefully Crypto can help me understand homomorphic cryptosystems. I'm designing a high score server for a game I made, and because of facets in the language i'm using, the player would be able to ...
4
votes
2answers
3k views

Secure private key storage

I'm developing application in Java that has to store RSA keys in software for foreseeable future (that is, at least 10 years). The two most common standards of storing private keys are PKCS12 and JKS ...
4
votes
1answer
278 views

Why does RSA give better security on longer messages?

I am trying to understand the notion of RSA security. Choosing a public exponent where $e = 3$ facilitates the calculations, considering that it is secure if the plaintext or message is long. If the ...
4
votes
1answer
226 views

Signing a GCM MAC

If I encrypt a message with AES-GCM, is it safe to use the MAC as the hash in a DSA/RSA signature? That is, if someone knows the AES key and nonce, will they be able to generate a different message ...
4
votes
1answer
970 views

RSA with modulus product of many primes

I would like to ask what happens if we build an RSA system with modulus a product of more than 2 primes, for example let $n=p_{1}p_{2}...p_{L}$. I know only the classical RSA system with $n=pq$ with ...
4
votes
2answers
5k views

What makes RSA secure by using prime numbers?

I am just learning about the RSA algorithm. Looking at the first two steps: Choose two distinct prime numbers $p$ and $q$. Compute $n = pq$. I have some probably stupid questions: Why do $p$ ...
4
votes
1answer
213 views

What is the property of RSA where N=e?

In RSA, suppose we know that $e=N$ and we are given the value of $e$. ($N = p\cdot q$ for some large primes $p$ and $q$; $\gcd(e, \varphi(N) = 1)$ Can we calculate $d$ ($d = e^{-1} \mod ...
4
votes
2answers
191 views

How can one encrypt with RSA (or ElGamal) without revealing whom the ciphertext is intended for?

Imagine Alice wants to encrypt for Bob and post this encryption publicly, so that only Bob can decrypt but no one can other than Alice or Bob tell that the message was encrypted for Bob. The naive ...
4
votes
4answers
681 views

How do institutions like banks do RSA with big primes?

When encrypting with RSA it is often infeasible to decrypt by just doing c^d mod n, because for example when using the primes $(p,q)=(12553,1233)$, which are small ...
4
votes
1answer
450 views

RSA Encryption and Signature - Weak Padding

Assume that I have an plaintext $m$ and it is padded with $randompad||00||m$ and then it is encrypted with RSA and a public encryption key so we get the encrypted $Sm$. Then to assure its integrity ...
4
votes
1answer
632 views

is this RSA private key valid?

is this RSA private key valid? First, here's the RSA private key in question: ...
4
votes
1answer
204 views

Using Lattice-based cryptography for TLS\SSL

Given the general benefits of Lattice-based cryptography, such as: Post quantum Security Security from worst case scenario Efficiency What could the outlook of shifting from RSA \ ECC-based ...
4
votes
1answer
686 views

Is PKCS #1 v1.5 RSA encryption padding secure under these conditions?

The PKCS #1 v1.5 padding scheme for RSA has been proven to have some weakness when used with TLS for example. My question is: is it still secure under the following conditions? Alice sends a ...
4
votes
1answer
753 views

Questions about OAEP for RSA

I have two questions about OAEP for RSA. How are the number of bits to pad with 0 chosen? For example, if I'm sending a 255 byte message with RSA-2048 I have 8 unused bits (1 byte). Should I split ...
4
votes
1answer
1k views

Good entropy source for generating openssl keys

I need to generate a CA (4096-bit RSA) and server keys for openvpn and I want them to be "top quality". Here is my plan: gather entropy from multiple sources (saving individual files): FreeBSD ...
4
votes
2answers
628 views

RSA least significant bit oracle attack

I have been reading up on RSA attacks and came across one that could be called a least-significant-bit (LSB) oracle attack. For the sake of clarity lets define RSA primes $(p, q)$, private key $d$ ...
4
votes
2answers
306 views

Proof of elliptic curve difficulty

Are there any proofs that cryptographic functions on an elliptic curve are any more difficult than the analogues over modulo arithmetic? While at present, ECC appears to be more difficult, as it is ...
4
votes
1answer
137 views

low-exponent RSA

I have questions from http://link.springer.com/chapter/10.1007%2F3-540-68339-9_1 Suppose we have 2 messages $m_1$ and $m_2$ related by a known relation $m_2=m_1+1$. Suppose further the messages are ...
4
votes
1answer
196 views

Combining AEAD with RSA

'Hybrid' encryption, where we combine symmetric encryption with public-key cryptography, is pretty 'tried and tested'. To summarise, we generate a symmetric key and encrypt it using RSA. We would ...
4
votes
1answer
346 views

Question about why RSA is hard to attack

I think I understand why RSA is hard to attack but I'd like to get clarification if I actually do. Assume there are two people, Alice and Bob, who are attempting to communicate privately but that we ...
4
votes
1answer
135 views

Multiplication-homomorphic schemes

I'm looking into multiplication-homomorphic schemes now and basically I see that there are 3 options: RSA, Boneh-Goh-Nissim and ElGamal. RSA was proved to be insecure unless message is randomly ...
4
votes
1answer
214 views

Factoring two RSA modulus with known $|p_1 - p_2| < \ell $

I have two 1024bit RSA modulus $N_1 = p_1q_1$ and $N_2 = p_2q_2$ such that $0 <|p_1 - p_2| < \ell$, and $\ell$ is at most 64bit integer. Can I factorise $N_1$ and $N_2$? What's the answer when ...
4
votes
2answers
146 views

How can one calculate the estimated RSA key life based on Moore's law?

How can someone estimate the number of years needed to factor an RSA key based on the advancement of technology if followed Moore's law?
4
votes
1answer
903 views

Can you help me understand the Common Modulus Attack in a Lucas Group?

I'm trying to decrypt a message that is encrypted using a LUC encryption scheme and running into roadblocks. I know that with RSA if Alice and Bob use the same public modulus but different encryption ...
4
votes
3answers
610 views

How can I prevent a message replay with RSA?

I am using RSA to encrypt some data but I would like to eliminate the possibility of message replay. By message replay I mean sending a valid message multiple times to the original recipient. It is ...
4
votes
2answers
2k views

Are there any standards of multi-prime RSA key generation?

FIPS 186-3 specifies a method to generate DSA parameters. Is there anything similar (official standard or widely-accepted recommendation) that shows how to generate the primes for multi-prime RSA?
4
votes
0answers
183 views

Ring Signature - paper/code difference in trying to solve inverse trap door function?

there is a paper on ring signatures and a python implementation of it here. The Step 4 in the paper describes $y_s = v =C_k,_v(y_1, y_2, ... y_r)$ for all $1 \leq i \leq r$ where $i \neq s$. The ...
3
votes
5answers
927 views

What is the SSL private key file format?

I was researching about how to encrypt with RSA. I understood everything but not the format of the private keys. In the phpseclib (RSA in PHP), you can import your private key (private.key format) ...
3
votes
3answers
697 views

How can I avoid calculating with huge numbers when implementing the RSA algorithm

There is 26-letter English alphabet. There is the plain text: TRYAGAINLATER. I need to encrypt it by RSA algorithm with the public key 53. What is the ciphertext? ...
3
votes
2answers
189 views

Key space vs Cardinality of 1024-bit RSA

I have been trying to figure out the encryption key space, and cardinality of 1024-bit RSA. From my understanding, the key generated from 1024-bit will be primes greater than $2^{1023}$ but less than ...
3
votes
2answers
310 views

Small Prime Difference in RSA

In RSA, the $p$ and $q$ should be randomly generated, and they are the same size. The difference between $p$ and $q$ should not be small. Suppose that $u=|p-q|<20$ and $p \times q ...
3
votes
2answers
225 views

Are there any papers explaining how to port textbook RSA to realworld RSA?

Are there any papers, books, or link where it explains how the plain vanilla "textbook RSA" is actually implemented in practice with all the padding and stuff? Basically, I would like to know the ...
3
votes
1answer
809 views

Theoretical attack on RSA

The high security of RSA is granted, because it is very hard to factorize $$ N = p * q $$ Nevertheless, there is actually no need of factorizing $N$, in order to generate the $Private$ $Key$, but the ...
3
votes
3answers
196 views

Can the encryption exponent e be greater than ϕ(N)?

So I was just wondering in RSA, can the encryption exponent e be greater than ϕ(N)?? For an examples sake, lets just say N = 707, so p = 101 & q = 7. So, we have ϕ(707) = 600. Can I have e = ...
3
votes
2answers
1k views

Is RSA in a ECB-like-mode safe for bulk encryption?

Let's say I would like to communicate with my friend using asymmetric/public-key encryption, e.g. RSA. (Note: I do realize that in practice this is done through an intermediate symmetric key, but ...
3
votes
2answers
614 views

Does RSA padding have to be unpredictable if the payload is?

I'm trying to understand the precise requirements on padding when using RSA for encryption. Suppose Alice uses RSA to encrypt a payload $M$ that cannot be guessed (say, a random nonce): Alice send ...
3
votes
2answers
851 views

Which attacks are possible against raw/textbook RSA?

The PKCS#1 standard defines multiple padding schemes for signature generation/verification (EMSA-PSS and EMSA-PKCS1-v1_5), and encryption/decryption (EME-OAEP and the less safe EME-PKCS1-v1_5). ...
3
votes
2answers
289 views

Avoiding overflow when encrypting with RSA

When encrypting with RSA one calculates $ m^e \pmod n $ by doing the following: m^e % n Where $m$ is what we encrypt. Often $e$ is a very big number to make it ...