an asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption.

learn more… | top users | synonyms

2
votes
2answers
641 views

Chosen plaintext attack on textbook RSA decryption

Let $(n,d)$ be an RSA private key and $(n,e)$ the corresponding public key. Generate a secret random $r$ from $(\mathbb{Z}/n\mathbb{Z})^*$ Compute $C’ = C (r^e) \bmod n$ Submit $C’$ as a chosen ...
2
votes
1answer
872 views

Certificate signature with SHA-1 and RSA: where do 1888 bits come from?

Plenty of X.509 Certificates use "PKCS#1 SHA1 with RSA encryption" as the Certificate Signature Algorithm for generating a 2048-bit signature. The SHA-1 hash function generates a hash value of 160 ...
2
votes
1answer
346 views

What kind of machine can generate 100-400 digits prime number? RSA

The 64 bit machine's biggest number can be 2^63 (9,223,372,036,854,775,807). So what kind of a monstrous machine can generate 100-400 digits prime number? I probably don't understand something, so ...
2
votes
2answers
493 views

Openssl & RSA : how many public exponents are possible?

I would like to know if it is possible to set the public exponent we want with "OpenSSL RSA" or if it is really limited to 2 possible exponents: 3 65537 If yes, why ?
2
votes
2answers
374 views

Please punch holes in this authentication scheme

Folks, I am undertaking a crypto course in Uni. Our professor asked us to try and design some authentication schemes which are resistant to active attacks. This was just a in class exercise to get us ...
2
votes
2answers
292 views

It is reasonably safe to leave a SSH private key with a 30+ character passphrase public?

I'm curious about exploring uses for a distributing a single RSA private key with a passphrase instead of trying to secure the private key and distribute the public key. With the private key (and ...
2
votes
1answer
248 views

RSA Key generation Public exponent too big

I'm currently writing a paper about RSA (a self-chosen subject). I'm writing about the key-generation in RSA, and I have problem finding the public exponent e. I have chosen p = 61 and q = 53. Then ...
2
votes
1answer
1k views

How to sign a message using RSA?

Assuming I already have a D, P, Q, etc of an RSA key: How do I now sign a message? If it matters – the message is around 100 bits. I don't know much about cryptography, but I can get these numbers ...
2
votes
1answer
284 views

Why should the primes used in RSA be distinct?

The two primes $p$ and $q$ part of the public key need to be distinct. What's the reason for them to be distinct? Is it because factorization of $p^2$ where $p$ is a prime is relatively easier, or is ...
2
votes
1answer
71 views

For which RSA moduli, precisely, is $e=d$ for all $e$?

This question shows that there are at least two valid RSA moduli $n$, namely $35$ and $91$, such that for any $e$ coprime to $\lambda(n)$, $$e^2\equiv1\mod\lambda(n)\text.$$ Reading the linked ...
2
votes
1answer
100 views

RSA private exponent primality

I know that the public exponent is always a prime, but what about the private exponent? Is it always a prime too?
2
votes
2answers
2k views

At what stage is DHE and RSA used during the SSL/TLS handshake?

At what stage of the SSL/TLS handshake is the DHE and RSA used and what is the purpose of using a pre-master secret when you could just use RSA to exchange the symmetric key (i.e. AES) for further ...
2
votes
2answers
153 views

Publicly exposed hash of private key

Would exposing a cryptographic hash function's digest (e.g. SHA-3) of RSA private key data compromise the key? If so, what are the possible (cryptanalysis-) vectors for attacking the key if an ...
2
votes
2answers
550 views

Computing p and q from private key

We are given n (public modulus) where n=pq and e (encryption exponent). Then I was able to crack the private key d, using Wieners attack. So now, I have (n,e,d). My question is, is there a way to ...
2
votes
1answer
608 views

How does OAEP improve the security of RSA?

The heart of OAEP algorithm used for RSA encryption are the cryptographic hash functions $H$ and $G$. Does everybody (so also an adversary) know these functions? If YES: How does it help the ...
2
votes
2answers
776 views

risk of attacker decrypting RSA ciphertext without public or private key

As I describe in my previous question I am trying to decide if it's worth it for me to use the Offline Private Key Protocol in creating some long term private archives, instead of just going with a ...
2
votes
3answers
2k views

Is it safer to encrypt twice with RSA?

I wonder if it's safer to encrypt a plain text with RSA twice than it is to encrypt it just once. It should make a big difference if you assume that the two private keys are different, and that the ...
2
votes
1answer
451 views

What is the strength of unpadded RSA?

I would like to use unpadded RSA for homomorphic encryption in a toy P2P game, for things like fair coin flips and shuffling. How many bits of security does unpadded RSA have, in relation to its key ...
2
votes
3answers
4k views

RSA Proof of Correctness

Can anyone provide an extended (and well explained) proof of correctness of the RSA Algorithm? And why is it needed? I can't say that this or this helped me much, I'd like a more detailed and newbie ...
2
votes
1answer
438 views

What algorithm does PGP use to encrypt email?

I know it uses RSA/DSA to create keys, but does it use that same algorithm for the actual cipher?
2
votes
1answer
211 views

Attack for RSA 1024 bit with Low Public Exponent

I am facing a challenge at university. Our teacher give us the challenge to try to break an RSA 1024 bit. We have public modulus N and public exponent e (0x03), we don't know the padding. We have a ...
2
votes
1answer
89 views

How do we guarantee plaintext is coprime in RSA?

The specifications for RSA state: $P^{\phi(N)} \equiv 1 ~mod~N$ if and only if $P$ and $N$ are coprime. Here $P$ is the plaintext and $N$ is the product of two suitable primes $x_1, x_2$. My question ...
2
votes
1answer
264 views

The Boneh-DeMillo-Lipton fault attack (RSA CRT)

I am trying to understand the Boneh-DeMillo-Lipton fault attack on RSA CRT signature. Suppose that we sign a message $m$ with RSA-CRT : $d_p = d \bmod (p-1)$ and $d_q = d \bmod (q-1)$ $s_p = ...
2
votes
3answers
144 views

Feasibility of finding public key when private key is known

We all know that in a public key cryptosystem, given a public key it is extremely hard to compute private key from it. Is it the same case in reverse? Given a private key, how easy is it to compute ...
2
votes
1answer
136 views

Pick faster private exponent

I recently tried to send 1536-bit modulus CSR to COMODO. They refused to sign the certificate. I later found out that it's because NIST mandated 2048-bit modulus on the SSL certificate. I think it's ...
2
votes
2answers
357 views

Private RSA key for HMAC key

I am creating software tokens for future request authentication, and I want to use an HMAC for the token to make them tamper-resistant. To ensure I can check the HMAC later I need a secret, persistent ...
2
votes
1answer
845 views

Is it true that for RSA with no padding, the length of data must be equal to the length of key?

The question pertains not in terms of security but computing operational functionality, as it how the computation is done. Is it true that for RSA with no padding, the length of data must be equal to ...
2
votes
1answer
240 views

Where can I download a database of RSA keys?

I'm looking to do some research into how RSA is used in the wild. I've read through a few papers and it seems other researchers have had no trouble collecting millions of keys to perform analysis on. ...
2
votes
2answers
2k views

How to calculate the maximum output size for data encrypted with a RSA Private Key?

I have an an encryption algorithm I am working with that looks like this: prv_key_enc(sha1_hash(data)) Where, the RSA parameters are: RSA/ECB/PKCS1Padding 1024 ...
2
votes
1answer
174 views

Why encrypting with private and public keys produce the same result?

Let say $e = 5$, $n = 119$ and $d = 77$. If I encrypt, for example, $m=15$ I get: $$m_1 = m^e=15 ^ 5 \mod 119 = 36\qquad\text{and}\qquad m_2 =m^d= 15 ^ {77} \mod 119 = 36$$. Why? Is it always like ...
2
votes
1answer
374 views

RSA 896 vs 1024 vs 2048 in Javascript?

I am currently working on a secure messaging website and I had been using RSA 2048 for encryption, decryption and signing of messages but I found it to be EXTREMELY LAGGY so i've moved to 1024. I did ...
2
votes
1answer
175 views

Which platforms are most vulnerable to Simple Power Analyse Attack

In a "Simple Power Analyse Attack", the difference in power consumption during multiply or square operation is used. In the RSA decryption process with the "Square and Multiply" algorithm, both ...
2
votes
2answers
302 views

Chain several RSA encryptions without increasing the message size

I would like to be able to encrypt the output of RSA with RSA again without having the output grow in size over time. In other words, I have some data $D_0$ which I want to encrypt with RSA: $D_1 = ...
2
votes
1answer
419 views

Cracking an RSA with no padding and very small e

I have a project wherein I have to crack a given cipher text encrypted using RSA and have been given N and e. Can someone suggest an RSA attack using a very small exponent e(here e=3) and no padding?
2
votes
1answer
325 views

Is it possible to determine the group order by knowing the “public” and “private” key exponents in an RSA group?

I have an RSA group with modulus $n = p \cdot q$, two safe primes $p=2p'+1$ and $q=2q'+1$ and the "public" and "private" key exponents $d$ and $e$. $\phi(n) = 4p'q'$ is the order of the RSA group. If ...
2
votes
2answers
289 views

Is semantic security important in a hybrid cryptosystem?

RSA doesn't provide semantic security when used unmodified, and neither does the commonly used PKCS#1 v.1.5 padding scheme for encryption. Is this a problem for hybrid cryptosystems at all? My ...
2
votes
1answer
435 views

Why is RSA usually limited to messages up to 1 block

I'm wondering why RSA encryption usually is only used for messages that fit into one block. For larger messages hybrid encryption in combination with symmetric ciphers like AES seem to be the solution ...
2
votes
3answers
539 views

RSA finding the inverse of the public exponent

I have a very basic doubt in RSA key generation and its usage. In RSA key generation you choose two large prime numbers of a very large order. Then you multiply them.(eq $p \cdot q = N$) Now, ...
2
votes
1answer
197 views

ECC vs RSA: how to compare key sizes?

I know and I have understood the details of RSA, elliptic curve cryptography, (EC)DH and (EC)DSA. I keep reading everywhere that (if we don't consider non-deterministic computers) "ECC can achieve ...
2
votes
1answer
70 views

Retrieve value of private key after encryption with the public key

Is there a way to find an RSA private key after it is encrypted with the corresponding public key? Does there exist an algorithm to recover the private key in this special case?
2
votes
1answer
126 views

How multiplicative property of RSA can be exploited

It is known that RSA has the multiplicative property $E(m_1) \cdot E(m_2) = E(m_1 \cdot m_2)$ because $m_1^e \cdot m_2^e = (m_1 \cdot m_2)^e \pmod n$ But how can this property be used to break ...
2
votes
1answer
126 views

What use is the signature without the message under RSA?

Using RSA for signing & verification, is there a way to take a valid signature for an unknown message, and for someone else to generate a valid signature using a different key against the valid ...
2
votes
1answer
231 views

what are DP and DQ in Encryption by RSA in c#

I want to know about these tags in RSA Encryption by private Key. when I use this code: ...
2
votes
1answer
302 views

Calculate the RSA private exponent from the CRT parameters

I am trying to make the RSA structure of Openssl manually, knowing the public key ($n$, $e$) and the CRT parameters $p$, $q$, $d_P$, $d_Q$, and $u = q^{-1} \mod p$. That is, I want to get the $d$ ...
2
votes
1answer
1k views

Can I remove new lines in a public key?

Can I remove new lines from the rsa public key file to get a one line string? So the question is if the key looks like this AAA BBB CCC or ...
2
votes
1answer
402 views

Precomputation attacks on RSA

Are precomputation attacks - such as outlined in RFC 3610 chapter 5 - possible on RSA PKCS#1 v1.5 signature generation? If yes, are such attacks taken into account when calculating the cryptographic ...
2
votes
1answer
596 views

Montgomery Ladder vs Double-and-Add

I would like to know what (if any) are the advantages of using Montgomery Power ladder over the Double-and-Add-Always algorithm. I think that firstly, Monty would be slightly faster than DoubleAndAdd. ...
2
votes
2answers
613 views

RSA Key Generation Parameters - public exponent, certainty, string-to-key count

I want to know what values are appropriate for the public exponent and certainty when generating an RSA Key (for example using Bouncy Castle RSAKeyGenerationParameters function). What is the ...
2
votes
1answer
653 views

Attack of an RSA signature scheme using PKCS#1 v1.5 encryption padding

My best interpretation of this question is that Java's crypto API has been subverted to perform RSA signature using PKCS#1 v1.5 encryption padding. Assume the signature $S$ of a message $M$ is ...
2
votes
1answer
316 views

Why should a signature use PSS padding in RSA?

Suppose I send a message using AES (private keys already negotiated securely) and I send a hash of this message using RSA (encrypted with private key) with OAEP to verify the authenticity and ...