an asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption.

learn more… | top users | synonyms

3
votes
1answer
53 views

Need help understanding this exercise's solution

We were given this exercise, which asks us to identify the types of keys used on this diagram: The solution was Kxa -> A's private key Kya -> A's public key KxB -> B's private key My question ...
3
votes
1answer
107 views

Space needed to store an RSA private key

How much space is actually needed to store a $4096$-bit RSA private key? I originally assumed $0.512$ kB since $\frac{4096}{8} = 512$, but then I started to wonder whether it was in hex. Simply, what'...
3
votes
1answer
80 views

Is RSA encryption without padding secure with NIST Key Establishment schemes?

NIST SP800-56B standard (addressing IFC-based Key Establishment schemes) defines some key establishment (KE) schemes using the RSASVE primitive in which the common secret $Z$ is encrypted with RSA-EP ...
3
votes
1answer
195 views

Homemade Randomized RSA

Considering the following encryption scheme where RSA is used to encrypt a plaintext m and then we choose a random r and compute: $$A = r + m^e \bmod N$$ and $$B = r^e \bmod N$$ So the ciphertext is ...
3
votes
1answer
142 views

Theoretical decryption of RSA

I am currently looking into RSA and have some questions. I am interested in theoretical answers, assuming there is infinite time for decryption. Is it necessary to work out the private-key exponent ...
3
votes
1answer
233 views

How often does RSA-OAEP have a leading zero?

We are working with a third party vendor who is very tight lipped about their security protocols, and one of our customers who used this vendor's products is claiming that approximately one in every ...
3
votes
1answer
356 views

Decrypt all RSA ciphertexts if you can break 1% of them

I was given a cryptography question during an interview the other day. Imagine you are given an efficient algorithm which for a given RSA public key (n,e) is able to decrypt 1% of the messages ...
3
votes
1answer
121 views

Is xgcd faster than Fermat for calculating $d$ in RSA?

I want to calculate $d$ from $e$ when generating RSA keys. What is faster? Calculating $\operatorname{xgcd}(e,p)$ and $\operatorname{xgcd}(e,q)$ and CRT. Or calculating $e^{p-2}\bmod p$ and $e^{q-2}...
3
votes
2answers
3k views

How to calculate the maximum output size for data encrypted with a RSA Private Key?

I have an an encryption algorithm I am working with that looks like this: prv_key_enc(sha1_hash(data)) Where, the RSA parameters are: RSA/ECB/PKCS1Padding 1024 ...
3
votes
2answers
419 views

Any real world implementation using message recovery?

During my master thesis I came across RSA-PSS-R which is in my opinion a quite elegant way of saving bandwidth and space using digital signature. But I didn't find any information about any real world ...
3
votes
2answers
664 views

RSA encryption exponent

In RSA public-key material (e, N), why must the encryption exponent e be relatively prime to $\phi(N)$? Why must any public key encryption algorithm resist CPA?
3
votes
2answers
356 views

Chain several RSA encryptions without increasing the message size

I would like to be able to encrypt the output of RSA with RSA again without having the output grow in size over time. In other words, I have some data $D_0$ which I want to encrypt with RSA: $D_1 = \...
3
votes
1answer
1k views

Extract private RSA key from USB cryptographic token using Bardou et al. attack (variant of “million message attack”)

There is a side channel attack on tamper-resistant USB cryptographic tokens using padding-oracle, described by Bardou, Focardi, Kawamoto, Simionato, Steel and Tsay, titled "Efficient padding oracle ...
3
votes
1answer
322 views

How to find an element of high-order in an RSA group?

Is this even possible? The RSA group is not cyclic, so usually you wouldn't find a generator for accessing all group elements. What happens if you use the RSA group in a scenario where you want that ...
3
votes
2answers
682 views

RSA private key format for Mega

I've been trying to reverse engineer Mega's (mega.co.nz) API calls. And stopped on the step where client needs to decrypt session id with provided RSA key. I can get key data, but I have no idea how ...
3
votes
2answers
884 views

How much extra information is in an RSA public key?

I'm trying to calculate the size of an RSA public key in Ruby. I've retrieved the key in PEM format, and once I've decoded the base64 part from the PEM format, I get the size in bytes. What I find is ...
3
votes
2answers
149 views

When to prefer exchanging cryptographic certificates over exchanging only public keys?

Let's think of the following case: A group of peers want to exchange messages with each other. They use public-key cryptography to sign and encrypt messages. Anyone with any name can join the ...
3
votes
2answers
2k views

Proof of security for RSA signatures

I am new to here, I was having some problems with a problem I am working on: "For each of the following variants of the definition of security for signatures, state whether textbook RSA is secure ...
3
votes
1answer
2k views

Demonstrating the insecurity of an RSA signature encoding scheme

I'm working on problem 12.4 from Katz-Lindell. The problem is as follows: Given a public encoding function $\newcommand{\enc}{\operatorname{enc}}\enc$ and a textbook RSA signature scheme where ...
3
votes
1answer
177 views

What is the probability of attacking SHA1 used in RSA signature with small exponent?

There is RSA signature check which has following properties: RSA modulus N which is 2048-bit RSA public exponent equal 41 (0x29) Genuine Signature uses EMSA-PKCS1-v1_5 padding of SHA1 hash, however ...
3
votes
1answer
92 views

Why is padded RSA not CCA-secure?

Why is the padded RSA construction given in the picture not CCA secure?
3
votes
2answers
121 views

Can RSA (theoretically) be used as a block cipher?

Assume AES gets a devastating attack making it unusable. Is it possible to use RSA in a secure way that can encrypt data in bulk? I can't see how RSA (assuming OAEP padding) can be used in normal ...
3
votes
1answer
269 views

Why not use OAEP for signatures?

There seems to be a distinct lack of implementations of RSA signatures using OAEP to pad the digest. Other than the old, funky, padding schemes, it's PSS all the way. PSS seems to have the whiff of ...
3
votes
1answer
94 views

How to understand RSA Proofs of correctness at Wikipedia

From Wikipedia(https://en.wikipedia.org/wiki/RSA_%28cryptosystem%29#Proofs_of_correctness): $m^{ed}$ ≡ $m$ $\pmod{q}$ $m^{ed}$ ≡ $m$ $\pmod{p}$ then $m^{ed}$ ≡ $m$ $\pmod{pq}$ Question: if $m^{ed}$ ...
3
votes
1answer
184 views

Why don't use random padding in RSA?

Consider the following scenario: Sender S sends a message to receiver R. He uses a hybrid encryption scheme with RSA as key-encapsulation algorithm and AES-256-CTR (4byte-counter) and SHA256-HMAC. ...
3
votes
1answer
286 views

RSA public key recovery from signatures

Is it possible (how) to recover public (512 bit long) RSA key from multiple signatures having corresponding plain texts. Padding is not randomized. I need it to verify any future message comming from ...
3
votes
1answer
669 views

RSA Blind Signature Attack

In Information Security Class I learned a non-adaptive chosen ciphertext attack using "blinding" but I just can't follow the proof and therefore can't reconstruct it. From what I've found out, it ...
3
votes
1answer
149 views

Security Level Estimate when Cascading/Compositing Ciphers?

Way back when, DES had a theoretical security level 56-bits. 2-key TDEA provides about 80-bits of security, and 3-key TDEA provides about 112-bits of security. Obviously, those security levels are not ...
3
votes
1answer
3k views

Is it true for Java that the transformation mode and padding is ignored when using RSA?

Consider GregS's comment to this question (more specific to bouncycastle's provider implementation): http://stackoverflow.com/questions/11717646/bouncycastle-rsa-key-size-and-padding The mode, ...
3
votes
1answer
459 views

Appropriate AES key length for short term protection

Currently I'm doing some initial research for a fully connected distributed network communication model. The context here is a peer-to-peer multiplayer protocol, using a majority-voting system. More ...
3
votes
1answer
710 views

How difficult is it to brute force d in RSA: d = (1/e) mod φ in a CPT attack?

Given that RSA key generation works by computing: n = pq φ = (p-1)(q-1) d = (1/e) mod φ If I was an attacker who wanted to brute force d, could I brute force d given just the public key, the ...
3
votes
1answer
650 views

Can you identify the public key used to encrypt something?

If I encrypt a string with a public key, does the encrypted ciphertext reveal the public key I used to encrypt it? Basically, I don't want anyone to know who the ciphertext is addressed to. I'm ...
3
votes
1answer
2k views

Secure encrypt-then-sign with RSA

I understand that when you want to encrypt and sign data with RSA the generally recommended approach is sign-then-encrypt. However, I have encrypted data that I need to sign, to prove the author of ...
3
votes
1answer
197 views

Is this attack for RSA possible?

$N=p·q$ ($p$ and $q$ are prime numbers), $m_1, ..., m_x$ are the messages, $e$ and $d$ are RSA encryption and decryption exponents, respectively. I am given $e, m_1, m_1^e, m_1^d, ..., m_x, m_x^e, ...
3
votes
2answers
4k views

How do digital certificates work, and why is it not possible to reverse engineer one from a signed file?

Digital certificates are used quite commonly these days, for signing files. They are used by various operating systems to ensure reliability and security. For example, Android requires that each of ...
3
votes
1answer
639 views

How are the primes used to generate RSA keys?

I am confused about how keys in RSA asymmetric encryption are generated and what the implications for open communications are. Textbooks say the one-way function is merely two primes (with some ...
3
votes
1answer
36 views

Is there a way to turn a PGP key into its semi-prime counterpart?

From my understanding of PGP keys they use the RSA algorithms to encrypt/decrypt messages. So, I know that the RSA algorithms use a semi-prime number to encrypt/decrypt messages. So, what I was ...
3
votes
1answer
36 views

How does this solution guarantee authentication of B and privacy?

The exercise is: What could be changed on the second message " Kya(Kxb(Ra,Ks)) " to guarantee B's authenthicity and also privacy? My teacher's solution was "add a destination" , so it would be ...
3
votes
1answer
144 views

Trying to understand textbook exercise question regrading RSA

I am preparing for the final exam in my Data Security class so I am trying to read and understand the textbook's exercise questions. Any hint would be great. Question (Exercise 9.14 of textbook): ...
3
votes
1answer
80 views

Schnorr signature security level as compared to AES/RSA

As per the Schnorr's original paper (1991), The Security Complexity $2^t$: We wish to choose the parameters $p$, $q$ so that forging a signature or an authentication requires about $2^t$ steps by ...
3
votes
1answer
104 views

Anonymity problem after voting with blind signatures

In a distributed voting system (all the messages are public, but signed and maybe encrypted/blinded), having: $d$, $e$, $N$ — registrar key params $m$ — msg $r$ — random blinding factor $m'$ —...
3
votes
1answer
41 views

how is the rsa $publickey(n ,e)$ transformed into a textfile allowing its public distribtution?

wikipedia says about the keys itself: The public key consists of the modulus n and the public (or encryption) exponent e. The private key consists of the modulus n and the private (or ...
3
votes
1answer
255 views

RSA enc/decryption with multiple prime modulus using CRT

Every information I found on internet about RSA-CRT encryption/decryption uses only two primes. I'm interested in my project in doing that using multiple (up to 8) primes. The general idea is to ...
3
votes
1answer
196 views

RSA: Most significant key bit always 1?

Is it possible to say that the most significant bit of an RSA private exponent is always 1? Wouldn't that weaken the key strength by exactly that one bit? I refer to the paper "Timing Attack: What ...
3
votes
1answer
160 views

Symmetric encryption using RSA for random generated password

I'm fairly new to encryption, so I wanted to check the logic for a .net solution I'm working on that encrypts data between two parties. the receiving (decrypting) party will have an RSA key pair ...
3
votes
1answer
174 views

RSA 1024 bit forge a new matching signature from a chosen message

I have an RSA signature scheme with 1024-bit key where I know the following: Public modulus $N$ Public exponent $e=3$ A lot of signatures Summary: To compute a signature, an MD5 hash is ...
3
votes
1answer
621 views

Recommended password complexity for SSH key encryption using AES-256-CBC

When protecting SSH private keys with password-based encryption, what would be a good minimum password complexity+length standard to make cracking the password too difficult to be worthwhile anytime ...
3
votes
1answer
168 views

Is RSA vulnerable to the padding oracle attack?

I know that AES in combination with CBC mode is vulnerable against the Padding Oracle Attack. RSA also uses some kind of padding, hence can this attack be apply to RSA encrypted messages too?
3
votes
2answers
1k views

Using ECB as RSA encryption mode, but encrypted messages are unique

As I understand, ECB should not be used as encryption mode unless you are encrypting single blocks of data which are always unique and only are encrypted once. I have a collection of ids represented ...
3
votes
1answer
117 views

How to make PKCS conformation oracle for trying Bleichenbacher’s RSA attack?

I was trying to understand Bleichenbacher’s CCA attack and thought of work it out in python. Can some one throw some light on the the logic behind the oracle used to check PKCS conformation? Will a ...