an asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption.

learn more… | top users | synonyms

2
votes
1answer
386 views

How does OAEP improve the security of RSA?

The heart of OAEP algorithm used for RSA encryption are the cryptographic hash functions $H$ and $G$. Does everybody (so also an adversary) know these functions? If YES: How does it help the ...
1
vote
2answers
255 views

Why is the following RSA PRNG cryptographically secure?

One requirement states that the generator has to withstand the next-bit test. Consider the following PRNG, where we calculate next output $x_i$ via the formula $x_i = x_{i-1}^ e\mod n$. I can see ...
1
vote
2answers
4k views

Decrypt digital signature using RSA public key with openssl

I have a digital signature that was created using the following algorithm: a SHA-256 hash of the body of the message is calculated. It is then signed using an RSA private key and the result is ...
3
votes
1answer
759 views

Secure encrypt-then-sign with RSA

I understand that when you want to encrypt and sign data with RSA the generally recommended approach is sign-then-encrypt. However, I have encrypted data that I need to sign, to prove the author of ...
5
votes
1answer
267 views

Proof that padded RSA is CPA-secure

I'm referring to page 383 of J. Katz and Y. Lindell's Introduction to Modern Cryptography. The book presents a padded RSA: ${\bf Key Generation:}$ same as Textbook RSA (given security parameter ...
2
votes
2answers
484 views

risk of attacker decrypting RSA ciphertext without public or private key

As I describe in my previous question I am trying to decide if it's worth it for me to use the Offline Private Key Protocol in creating some long term private archives, instead of just going with a ...
0
votes
1answer
155 views

RSA - Ecrypting the same data with the same public key = same ciphertext?

If an adversary knows my public key and guesses what was my plaintext, can he test for it somehow? The most obvious way is encrypting the guessed plaintext with my public key and the same parameters ...
3
votes
1answer
133 views

implementing long term archive encryption

Let's say I want to create private archives for the long term (e.g. more than 30 ). The archives' sizes could be anywhere from 1 GB to 30 GB. As far as I understand I could go down two ways: The ...
3
votes
4answers
426 views

Tamper-proofing log files

Problem Overview I want to securely store log files so the contents are secret, and they can't be modified without detection. The files will be encrypted using authenticated encryption (AES in GCM ...
5
votes
1answer
249 views

In textbook RSA with low public exponent, how big does a random message needs to be?

Assume RSA with a public modulus $N$ of $n$ bits, a small odd public exponent $e$, plaintext $M$ a random non-negative integer less than $2^m$ for some integer parameter $m$, with $M\mapsto C=M^e\bmod ...
4
votes
1answer
176 views

Combining AEAD with RSA

'Hybrid' encryption, where we combine symmetric encryption with public-key cryptography, is pretty 'tried and tested'. To summarise, we generate a symmetric key and encrypt it using RSA. We would ...
2
votes
2answers
243 views

Chain several RSA encryptions without increasing the message size

I would like to be able to encrypt the output of RSA with RSA again without having the output grow in size over time. In other words, I have some data $D_0$ which I want to encrypt with RSA: $D_1 = ...
1
vote
1answer
90 views

How to learn the first bit of m in padded RSA

Consider the following version of padded RSA encryption, where encryption of $m$ is done by setting $m′ = (0^k~||~r~||~00000000~||~m)$ for a random $r$ (of length 8 btyes = 64 bits) and then computing ...
2
votes
1answer
65 views

Comprehension question on a signature protocol based on the RSA assumption

We have the following two-party protocol between Alice and Bob. Alice sends messages $m_1, m_2, \ldots \in_R \mathbb{Z}_n^*$ to Bob and Bob signs these values by calculating $v_1, v_2, \ldots \in_R ...
9
votes
3answers
3k views

What is the relation between RSA & Fermat's little theorem?

I came across this while refreshing my cryptography brain cells. From the RSA algorithm I understand that it somehow depends on the fact that, given a large number (A) it is computationally ...
2
votes
2answers
672 views

What data is saved in RSA private key?

What data is saved in RSA private key in openssl? How to view it? Wikpedia says these variables are saved.
2
votes
2answers
326 views

How can mega store my login details and still be secure?

I understand how Mega's encryption works. For a quick summary of all those in the future looking for an answer on this... here is how it works: Upon first signing up for an account you make a ...
5
votes
2answers
2k views

What are advantages of using a HMAC over RSA with SHA-1 hashes?

I am currently studying for an exam and this was a previous question: Give one advantage of using HMACs over using RSA to sign SHA-1 hashes. My thoughts are that it has something to do with the ...
2
votes
2answers
217 views

It is reasonably safe to leave a SSH private key with a 30+ character passphrase public?

I'm curious about exploring uses for a distributing a single RSA private key with a passphrase instead of trying to secure the private key and distribute the public key. With the private key (and ...
4
votes
2answers
564 views

Why are RSA key sizes almost always a power of two?

I know that other bit sizes are possible, e.g. this HTTPS server seems to have a 9000 bit key https://www.ssllabs.com/ssltest/analyze.html?d=qqq.gg, but it's very rare that one sees a key not of size ...
3
votes
2answers
463 views

RSA private key format for Mega

I've been trying to reverse engineer Mega's (mega.co.nz) API calls. And stopped on the step where client needs to decrypt session id with provided RSA key. I can get key data, but I have no idea how ...
0
votes
1answer
74 views

RSA Certificate Owner and Issuer line meanings?

Apologies if this question is not in the right place. I've recently been looking through some RSA certificates ( specifically, Android apk .rsa files) and I'm having trouble deciphering the one and ...
0
votes
1answer
148 views

Solving congruences using PARI

I'm having trouble finding info in the docs about how to solve a system of congruences. The closest I can find is 'matsolvemod' in here: ...
1
vote
0answers
159 views

Method and explanation for calculating difference in speed between DES and RSA

Our assignment asks us to convert an RSA speed in bytes per second to a DES speed in bytes per second. Our professor's treatment of this ("RSA is 100 times slower than DES") seems insufficient. Could ...
2
votes
1answer
242 views

Is this method for exchanging private key using RSA sound?

Bob know's Alice's public key, and he wants to make sure he's connecting to the one which has that key. Furthermore, Alice wants to verify when she gets a connection from Bob who'll give his public ...
1
vote
1answer
328 views

Possibility of factorisation of rsa modulus due to vulnerability in java implementation code

Below is my implementation of the RSA algorithm. Actually I'm choosing the private key (d) instead of public key (e) and computing the public key.It is working fine but I want to know if this is a ...
5
votes
1answer
127 views

In RSA, how to make sure that $p-1$ and $q-1$ are still hard to factorize?

See this question. The comment by Brett Hale stated: On the other hand, ensuring $(p - 1)$ has a large prime factor requires very little extra effort. What's actually the 'little extra effort'?
2
votes
1answer
303 views

Are RSA signatures deterministic?

If I sign the word HELLO with the mechanism "NONEwithRSA" with the same private key, do I always will have the same signature? A Java example always return ...
4
votes
1answer
265 views

Question about why RSA is hard to attack

I think I understand why RSA is hard to attack but I'd like to get clarification if I actually do. Assume there are two people, Alice and Bob, who are attempting to communicate privately but that we ...
0
votes
1answer
282 views

Why are RSA keys encoded with ASN.1 for TLS?

Browser vendors use ASN.1 encoding for RSA certificates in the TLS protocol. RSA public keys are just a number, so why do we need encode them to something else? That increases the risk of security ...
2
votes
3answers
838 views

Why is RSA encryption significantly faster than decryption?

I am designing an implementation of RSA . I recorded computation times in Java by using System.currentTimeMillis(). It returned an encryption time of 0.05 ms and ...
1
vote
0answers
80 views

Strong RSA problem in $\mathbb Z^*_{n^2}$

Comparing to this question, assume $C, M \in \mathbb Z^*_{n^2}$, $e \ge 3$, is it hard to compute $M$ that satisfies $C=M^e \mod n^2$ when $C$ and $(n, e)$ are given?
3
votes
2answers
392 views

How does the cyclic attack on RSA work?

I am trying to get the idea of cyclic attacks againts assymetric RSA encryption. Taken from Handbook of applied cryptography . Let $k$ be a positive integer such that $$c^{(e^{k})} = c\mod n ...
1
vote
2answers
227 views

Is semantic security important in a hybrid cryptosystem?

RSA doesn't provide semantic security when used unmodified, and neither does the commonly used PKCS#1 v.1.5 padding scheme for encryption. Is this a problem for hybrid cryptosystems at all? My ...
1
vote
2answers
95 views

What is RSA key normalization?

How can I understand the term RSA key normalization? What exactly is done in the process?? Please explain.
1
vote
1answer
2k views

How do I derive the time complexity of encryption and decryption based on modular arithmetic?

I want to calculate the time complexity of two encryption and decryption algorithms. The first one (RSA-like) has the encryption $$ C := M^e \bmod N $$ and decryption $$ M_P := C^d \bmod N. $$ ...
3
votes
1answer
196 views

How to find an element of high-order in an RSA group?

Is this even possible? The RSA group is not cyclic, so usually you wouldn't find a generator for accessing all group elements. What happens if you use the RSA group in a scenario where you want that ...
1
vote
1answer
79 views

What is the most secure way to let Alice “input” her private key, transfer it to the server and decrypt the message?

What is the most secure way to let Alice "input" her private key, transfer it to the server and decrypt the message? (Then destroy the private key on the server) Every connection is using SSL. ...
2
votes
2answers
162 views

Is it safe to use RSA as a proof-of-work system?

Suppose I devised the following challenge-response proof-of-work system: A server generates a 2048-bit RSA modulus, and uses the "public" exponent (usually 65537) to sign a random nonce a fixed ...
4
votes
1answer
650 views

What happens if an RSA key pair has identical public and private exponents?

Rather, is it possible for big prime numbers? Classroom examples usually involve smaller primes, so for example if you are given a prime number pair $p = 3$, $q = 13$ you would get $n = 39$ and $e = ...
9
votes
1answer
2k views

Why do all SSH-RSA Keys begin with “AAAAB3NzaC1yc”?

My Friend and I have been generating a few ssh2-rsa keys and noticed that all the public keys began with "AAAAB3NzaC1yc". The similarity extended to "AAAAB3NzaC1yc2EAAAABIwAAAQEA" between two keys I ...
2
votes
1answer
255 views

Why is RSA usually limited to messages up to 1 block

I'm wondering why RSA encryption usually is only used for messages that fit into one block. For larger messages hybrid encryption in combination with symmetric ciphers like AES seem to be the solution ...
2
votes
3answers
1k views

Is 512-bit RSA still safe for signature generation?

The standard CSP on Windows XP only supports RSA up to 512-bit, which means that it's the maximum key size I can use for authenticity verification of updates. The public key is embedded in the ...
5
votes
4answers
1k views

Why is it important that phi(n) is kept a secret, in RSA?

Why is it important that $\phi(n)$ is kept a secret, in RSA?
0
votes
1answer
812 views

Why the following attack in common modulus RSA works?

Suppose that i share a common modulus $N$ with two users $u_1$ and $u_2$ with public, secret keys ($e_a,d_a$), ($e_b,d_b$). Why then $gcd(V,e_b)=1$ where $V=d_a*e_a-1/$W and $W=gcd(e_b,d_a*e_a-1)$ ...
0
votes
1answer
79 views

Tweaking textbook RSA to make the encryption a Pseudorandom function

Lets say I want to tweak/alter the textbook RSA encryption function to create a pseudorandom function by pre-processing the input. Suppose I do something simple like add 2 to the input before ...
1
vote
0answers
46 views

Generating Polynomials for the MPQS

I'm going to try and eventually factor RSA-100, but my current QS needs a lot of improvement, so I'm going to try and switch over to the MPQS. I'm a bit confused as to how the MPQS works, which is ...
2
votes
1answer
88 views

Individual bits of Textbook RSA

This question relates to the underlying RSA assumption. Forgetting about the fact that Textbook RSA is deterministic, I am curious about the assumed strength of the RSA problem. Does RSA hide all ...
3
votes
3answers
151 views

Can the encryption exponent e be greater than ϕ(N)?

So I was just wondering in RSA, can the encryption exponent e be greater than ϕ(N)?? For an examples sake, lets just say N = 707, so p = 101 & q = 7. So, we have ϕ(707) = 600. Can I have e = ...
3
votes
1answer
429 views

How much extra information is in an RSA public key?

I'm trying to calculate the size of an RSA public key in Ruby. I've retrieved the key in PEM format, and once I've decoded the base64 part from the PEM format, I get the size in bytes. What I find is ...