an asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption.

learn more… | top users | synonyms

0
votes
1answer
118 views

Determining message given cipher-text and public key [duplicate]

Consider the following scenario: Suppose A and B have set up their RSA public keys, namely $(e_a, n)$ and $(e_b, n)$, where the n-value is the same. Also, it happens that the $\gcd (e_a, e_b) ...
24
votes
2answers
1k views

What security authorities and standards reject $e=3$ in RSA, when, and with what rationale?

In RSA, some security authorities and/or standards allow the public exponent $e=3$, others require or recommend $e>2^{16}$ (or perhaps some other minimum). I gathered the following: PKCS#1 allows ...
5
votes
2answers
394 views

Is RSA encryption of a cryptographic hash with a private key the same as signature generation?

It is often said that RSA encryption with a private key is the same as signing (signature generation). Will RSA encryption with a private key over a cryptographic hash give the same result as ...
0
votes
0answers
135 views

Franklin-Reiter related message attack m2 = a(m1)+b

As shown in their paper, https://www.cs.unc.edu/~reiter/papers/1996/Eurocrypt.pdf, if one is given an equation relating the two messages m1 and m2 as well as other information one can crack both the ...
0
votes
1answer
84 views

In RSA, why does Alice's $N$ need to be relatively prime to Bob's $N$?

I was asked this by my professor and I didn't understand the reasoning behind it. If Alice has a the key pair $(p_a, n_a)$ and Bob has the key pair $(p_b, n_b)$, why do $n_a$ and $n_b$ have to be ...
3
votes
1answer
186 views

Security of RSA with $\gcd(pq, (p-1)(q-1))\ne 1$

The Congress of ThéOùÇa enacted that civilian use of any public-key encryption system is authorized on the territory of ThéOùÇa, subject to meeting certain security requirements published by the ...
1
vote
1answer
141 views

File format of an $2048$ bits RSA public key

From here, there are $14$ bytes specifying the file format of the key. I am still quite confused about the format bytes. For example, the following public key 30 82 01 0a 02 82 01 01 00 8e a3 d1 c7 ...
0
votes
0answers
83 views

Is a RSA 2048 bits public key secure [duplicate]

I realize servers such as Google, Yahoo, which use RSA has 2048 bits public key. After comparing those keys, I realize that the public keys share a common property, that is first 9 bytes and last 5 ...
2
votes
2answers
474 views

Openssl & RSA : how many public exponents are possible?

I would like to know if it is possible to set the public exponent we want with "OpenSSL RSA" or if it is really limited to 2 possible exponents: 3 65537 If yes, why ?
1
vote
2answers
242 views

RSA Decryption given n, e, and phi(n)

my cryptography professor gave us this problem for extra credit a while back and I attempted it but I didn't get it correct. I have gone back to it, but I'm even more lost now than I was the first ...
0
votes
1answer
50 views

When homomorphic encryption goes wrong?

Consider I have two ciphertext $c_1$ and $c_2$ encrypted using RSA encryption. By definition if I multiply them I'd get $c_1.c_2 \ modN$. My question is what would happen if $c_1.c_2 >N$. Can we ...
0
votes
1answer
97 views

RSA CRT modulo reduction

I am working on RSA CRT and there is a point that I don't understand : So we have $n=pq$ and $c = m^e \bmod n$ an encrypted message. To decrypt $c$ with RSA CRT, we have to compute : $d_p = d \bmod ...
0
votes
1answer
36 views

RSA signature scheme

In RSA signature scheme, it is a common practice to 'sign' the hash value of the message so that the length can be fit. Question: If we have $s=m^d \bmod n$ where $d$ satisfies $ed \equiv 1 ...
0
votes
0answers
59 views

Low exponent attack against RSA

According to this: http://www.cims.nyu.edu/~regev/teaching/lattices_fall_2004/ln/rsa.pdf One can calculate the message m, if there was no padding scheme involved. My question: is it possible to find ...
2
votes
1answer
257 views

The Boneh-DeMillo-Lipton fault attack (RSA CRT)

I am trying to understand the Boneh-DeMillo-Lipton fault attack on RSA CRT signature. Suppose that we sign a message $m$ with RSA-CRT : $d_p = d \bmod (p-1)$ and $d_q = d \bmod (q-1)$ $s_p = ...
0
votes
1answer
117 views

Is there any probabilistic version of RSA?

I have now studying the RSA, but I think that is it possible to have some probabilistic version like a random bit string "r" XORed with the key? Is there any probabilistic version of RSA? Thak you ...
1
vote
2answers
105 views

RSA prove $a^{\varphi(n)/g} \equiv 1 \pmod{n}$

I should prove that $a^{\varphi(n)/g} \equiv 1 \pmod{n}$, so I thought I would prove it with primitive roots but I got stuck. Here is the assignment: Let $p, q$ be primes such that $p \ne q$. ...
2
votes
2answers
600 views

Chosen plaintext attack on textbook RSA decryption

Let $(n,d)$ be an RSA private key and $(n,e)$ the corresponding public key. Generate a secret random $r$ from $(\mathbb{Z}/n\mathbb{Z})^*$ Compute $C’ = C (r^e) \bmod n$ Submit $C’$ as a chosen ...
1
vote
2answers
304 views

Use case of RSA CRT

I discovered the CRT version of RSA cryptosystem which is used in many crypto libraries (openSSL, Java...). The use of the Chinese Remainder Theorem improves the speed of decryption so why it's not ...
2
votes
1answer
95 views

Recover plaintext in passive attack of RSA of coprime public key

I have a situation in RSA like this. Charles sends same message $m$ to Alice and Bob encrypted with $e_A$ and $e_B$ respectively. It happens that he they are under same modulus $n$ and $gcd(e_A, ...
2
votes
1answer
99 views

Implementation of garbled circuits using RSA

I was just reading these notes on garbled (Yao) circuits and I just stuck trying to figure out how an implementation of Table 1 would work using RSA encryption. In RSA the public key is (n,e). So for ...
7
votes
1answer
547 views

What is the history of recommended RSA key sizes?

One can find up to date recommended key sizes for RSA at http://csrc.nist.gov/publications/nistpubs/800-131A/sp800-131A.pdf for example. In short it suggests a key size of at least 2048 bits. Is it ...
1
vote
1answer
205 views

Compare two approaches for cracking RSA key

I came across these questions while studying for a crypto course, does anyone have any ideas on how to answer these? (a) Random prime numbers of size 1536 bits are chosen to generate an RSA modulus ...
7
votes
2answers
1k views

How to better generate large primes: sieving and then random picking or random picking and then checking?

I'm writing an RSA algorithm, and am wondering what is the best and/or usual way to choose the initial prime numbers (p and q). I know of two methods to achieve this, one based on a prime number ...
1
vote
2answers
194 views

How do RSA and ElGamal key sizes compare?

I have a rather silly question regarding the comparison of RSA with ElGamal over integers. If you want to compare their performance in the same level of security, does the modulus of both of them need ...
1
vote
1answer
263 views

How costly is to find millions of large prime numbers for RSA?

Consider I need to assign a large distinct prime number to each element in a large set. This must be deterministic so the function always gives me the same prime to the same value. What is the most ...
-1
votes
1answer
432 views

Is it possible to find plaintext from ciphertext if (n) and (a) are known for RSA?

I have a couple of questions pertaining to a RSA problem. I need to decipher some ciphertext and find out what the original plaintext was. Modulus: $n = 2537$ and exponent: $a = 11$ Encrypting ...
4
votes
1answer
1k views

RSA example-calculation: Public Key = Private Key (e = d)

I am a bit confused. I just calculated manually the single steps of RSA for an implementation with small numbers and suddenly $d$ was equal $e$. Please help me understand what I am doing wrong. ...
1
vote
1answer
86 views

RFC3447 OBJECT IDENTIFIER semantic

http://tools.ietf.org/html/rfc3447#appendix-B.1 ...
1
vote
1answer
86 views

Breaking RSA moduli

Let suppose that the sizes of factors $p$ and $q$ are $b$ bits. We construct two RSA numbers $n$, $n'$ of same sizes. Can we say that the duration to break these two numbers is two times the duration ...
-1
votes
1answer
249 views

RSA given q, p and e?

I am given the q, p, and e values for an RSA key, along with an encrypted message. Here are ...
0
votes
1answer
141 views

Is this chat protocol safe?

I am in the design phase of a secure chat application at the moment. I am trying to make this as secure as possible. The Serverprovider should not have access to the messagedata. So my idea was the ...
2
votes
1answer
221 views

Small Encryption Exponent

I am trying to crack an unpadded RSA set up for a homework. I have public key (R,e) and encrypted message E. ...
1
vote
3answers
312 views

What is h in this RSA variant?

I am trying to implement a proposed improved algorithm of RSA . Here the author has increased the number of exponents. However I am unable to understand what $h$ is in the Key generation step. Can ...
2
votes
1answer
206 views

what are DP and DQ in Encryption by RSA in c#

I want to know about these tags in RSA Encryption by private Key. when I use this code: ...
3
votes
3answers
176 views

Why are we not using multiple ciphers per message?

I am aware of at least rsa, elgamal-encryption, and variations of elliptic-curves relying on different problems and that those problems are considered hard. However, if someone figures out a way to ...
2
votes
1answer
265 views

Calculate the RSA private exponent from the CRT parameters

I am trying to make the RSA structure of Openssl manually, knowing the public key ($n$, $e$) and the CRT parameters $p$, $q$, $d_P$, $d_Q$, and $u = q^{-1} \mod p$. That is, I want to get the $d$ ...
2
votes
1answer
306 views

Hierarchical Encryption

Is there a way to setup a hierarchical encryption using public key encryption? Let's say a higher level user can decrypt messages encrypted by lower level users. Is that possible? I guess it is only ...
2
votes
1answer
231 views

Generation of N bit prime numbers -> what is the actual range?

Short version: When generating a prime number of N bits, should I draw random numbers from the range $[0 , 2^n]$, or $[2^{(n-1)} , 2^n]$? Context: I'm trying to implement a toy-version of RSA as a ...
1
vote
0answers
61 views

exchanging private key between service and iPhone app - digital signing

I need to do digital signing of my request data which will be sent to the server. My server sends distinct private keys to her clients after authentication and expects all responses to be digitally ...
1
vote
0answers
94 views

Is it possible (how difficult) to find MORE than one valid RSA signature?

Is it possible (how difficult) to find more than one valid RSA signatures for a given message m (after padded) and a public key ...
4
votes
3answers
3k views

What is the length of an RSA signature?

Is it the same as the bits of the key (So a 2048 bit system will yield a 2048 bit signature)? At most as the key? Or something else entirely?
3
votes
0answers
101 views

Finding algorithm: desire RSA's uniqueness and ECDSA's space efficiency

I am asking for help in finding a signature algorithm with the following property: Given a message m and a private key prikey, ...
0
votes
2answers
266 views

Why would an RSA library tell me that the public key must be at least 512 bits in size?

I'm trying to interoperate with a web service by reverse-engineering it. Currently, when sending a POST request, it encrypts the form data one-by-one with a 'RSA' function. But it's rather weird as ...
2
votes
3answers
141 views

Feasibility of finding public key when private key is known

We all know that in a public key cryptosystem, given a public key it is extremely hard to compute private key from it. Is it the same case in reverse? Given a private key, how easy is it to compute ...
1
vote
1answer
62 views

Verifying signature owner (without verifying the actual document)

Programming in Java. I have an RSA key-pair, a document, and a signature created with the Java Signature class, using SHA512WithRSA. In order to verify the signature, of course, I need to provide the ...
2
votes
2answers
399 views

SHA512withRSA - Looking for details about the Signature Algorithm

I am trying to find information about the Signature Algorithm SHA512withRSA and have been unsuccessful so far. In the current state, the signature is too long, so I would like to check the code for ...
2
votes
1answer
948 views

Can I remove new lines in a public key?

Can I remove new lines from the rsa public key file to get a one line string? So the question is if the key looks like this AAA BBB CCC or ...
1
vote
3answers
181 views

How is the following different than RSA Signing of a document?

If the goal is to demonstrate that you are who you say you are, I think the following will work: Bob wants to know that you are Amy. Bob encrypts a number using Amy's public key and then asks her what ...
5
votes
1answer
128 views

Understanding Genkin-Pipman-Tromer's ground potential, side channel attack on RSA

I'm pretty sure that by now folks might have come across this research from Genkin-Pipman-Tromer (GPT) on extracting the RSA key used by GnuPG (GPG) just by measuring the ground potential. I'm going ...