an asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption.

learn more… | top users | synonyms

3
votes
1answer
60 views

Selective and existential unforgability of signature schemes

I understand that one can define EUF-CMA of a signature scheme is terms of a game where the adversary is allowed to query signatures on messages of his choosing, and at the end of the game he must ...
3
votes
1answer
111 views

Should I be concerned about padding oracle attacks if the lifespan of my key is ~1 minute?

I'm using 4096-bit RSA to encrypt a 256-bit AES key generated client-side. The RSA ciphertext is then sent to the server, and the server decrypts the RSA ciphertext to acquire the AES key. ...
3
votes
1answer
75 views

RSA: Range of public modulus

I know the public modulus is the product of two primes. For key with length L, the public modulus N should be such ...
3
votes
2answers
209 views

Attacking unuauthenticated RSA

In symmetric cryptography, a scheme is not considered secure if the data transmitted is only encrypted. The adversary will be able to modify messages to generate encrypted messages of his choice ...
3
votes
1answer
1k views

Montgomery Ladder vs Double-and-Add

I would like to know what (if any) are the advantages of using Montgomery Power ladder over the Double-and-Add-Always algorithm. I think that firstly, Monty would be slightly faster than DoubleAndAdd. ...
3
votes
2answers
395 views

Is it possible that two distinct RSA moduli share both of their prime factors?

I am using an algorithm (can be found here1) that can compute efficiently the GCD of multiple RSA keys. It intended for RSA keys that were generated with low entropy and may have one of their primes ...
3
votes
1answer
750 views

Cracking an RSA with no padding and very small e

I have a project wherein I have to crack a given cipher text encrypted using RSA and have been given N and e. Can someone suggest an RSA attack using a very small exponent e(here e=3) and no padding?
3
votes
1answer
436 views

Is it possible to determine the group order by knowing the “public” and “private” key exponents in an RSA group?

I have an RSA group with modulus $n = p \cdot q$, two safe primes $p=2p'+1$ and $q=2q'+1$ and the "public" and "private" key exponents $d$ and $e$. $\phi(n) = 4p'q'$ is the order of the RSA group. If ...
3
votes
1answer
558 views

Why is RSA usually limited to messages up to 1 block

I'm wondering why RSA encryption usually is only used for messages that fit into one block. For larger messages hybrid encryption in combination with symmetric ciphers like AES seem to be the solution ...
3
votes
1answer
298 views

RSA Without Padding?

I've been looking at the weakness with plain/textbook RSA, where the same message is encrypted and sent to multiple destinations. In this case, it is possible to recover the message. Given that an ...
3
votes
1answer
2k views

“Signing” with public key

For this question, the following caveats and assumptions hold: There exists a 2048-bit RSA key pair used exclusively for signing/verification The private key is kept completely private There exists ...
3
votes
2answers
592 views

Is it possible to figure out the public key from encrypted text?

Suppose Alice sends messages to Bob by encrypting the messages with Bob's public key. Eve knows that the data is encrypted using RSA, but does not know the public key. Can Eve figure out the public ...
3
votes
1answer
5k views

RSA cracking: The same message is sent to two different people problem

Suppose we have two people: Smith and Jones. Smith public key is e=9, n=179 and Jones public key is e=13, n=179. Bob sends to ...
3
votes
1answer
54 views

Need help understanding this exercise's solution

We were given this exercise, which asks us to identify the types of keys used on this diagram: The solution was Kxa -> A's private key Kya -> A's public key KxB -> B's private key My question ...
3
votes
1answer
112 views

Space needed to store an RSA private key

How much space is actually needed to store a $4096$-bit RSA private key? I originally assumed $0.512$ kB since $\frac{4096}{8} = 512$, but then I started to wonder whether it was in hex. Simply, what'...
3
votes
1answer
82 views

Is RSA encryption without padding secure with NIST Key Establishment schemes?

NIST SP800-56B standard (addressing IFC-based Key Establishment schemes) defines some key establishment (KE) schemes using the RSASVE primitive in which the common secret $Z$ is encrypted with RSA-EP ...
3
votes
1answer
195 views

Homemade Randomized RSA

Considering the following encryption scheme where RSA is used to encrypt a plaintext m and then we choose a random r and compute: $$A = r + m^e \bmod N$$ and $$B = r^e \bmod N$$ So the ciphertext is ...
3
votes
1answer
144 views

Theoretical decryption of RSA

I am currently looking into RSA and have some questions. I am interested in theoretical answers, assuming there is infinite time for decryption. Is it necessary to work out the private-key exponent ...
3
votes
1answer
239 views

How often does RSA-OAEP have a leading zero?

We are working with a third party vendor who is very tight lipped about their security protocols, and one of our customers who used this vendor's products is claiming that approximately one in every ...
3
votes
1answer
359 views

Decrypt all RSA ciphertexts if you can break 1% of them

I was given a cryptography question during an interview the other day. Imagine you are given an efficient algorithm which for a given RSA public key (n,e) is able to decrypt 1% of the messages ...
3
votes
1answer
124 views

Is xgcd faster than Fermat for calculating $d$ in RSA?

I want to calculate $d$ from $e$ when generating RSA keys. What is faster? Calculating $\operatorname{xgcd}(e,p)$ and $\operatorname{xgcd}(e,q)$ and CRT. Or calculating $e^{p-2}\bmod p$ and $e^{q-2}...
3
votes
2answers
3k views

How to calculate the maximum output size for data encrypted with a RSA Private Key?

I have an an encryption algorithm I am working with that looks like this: prv_key_enc(sha1_hash(data)) Where, the RSA parameters are: RSA/ECB/PKCS1Padding 1024 ...
3
votes
2answers
424 views

Any real world implementation using message recovery?

During my master thesis I came across RSA-PSS-R which is in my opinion a quite elegant way of saving bandwidth and space using digital signature. But I didn't find any information about any real world ...
3
votes
2answers
673 views

RSA encryption exponent

In RSA public-key material (e, N), why must the encryption exponent e be relatively prime to $\phi(N)$? Why must any public key encryption algorithm resist CPA?
3
votes
2answers
357 views

Chain several RSA encryptions without increasing the message size

I would like to be able to encrypt the output of RSA with RSA again without having the output grow in size over time. In other words, I have some data $D_0$ which I want to encrypt with RSA: $D_1 = \...
3
votes
1answer
1k views

Extract private RSA key from USB cryptographic token using Bardou et al. attack (variant of “million message attack”)

There is a side channel attack on tamper-resistant USB cryptographic tokens using padding-oracle, described by Bardou, Focardi, Kawamoto, Simionato, Steel and Tsay, titled "Efficient padding oracle ...
3
votes
1answer
323 views

How to find an element of high-order in an RSA group?

Is this even possible? The RSA group is not cyclic, so usually you wouldn't find a generator for accessing all group elements. What happens if you use the RSA group in a scenario where you want that ...
3
votes
2answers
686 views

RSA private key format for Mega

I've been trying to reverse engineer Mega's (mega.co.nz) API calls. And stopped on the step where client needs to decrypt session id with provided RSA key. I can get key data, but I have no idea how ...
3
votes
2answers
897 views

How much extra information is in an RSA public key?

I'm trying to calculate the size of an RSA public key in Ruby. I've retrieved the key in PEM format, and once I've decoded the base64 part from the PEM format, I get the size in bytes. What I find is ...
3
votes
2answers
149 views

When to prefer exchanging cryptographic certificates over exchanging only public keys?

Let's think of the following case: A group of peers want to exchange messages with each other. They use public-key cryptography to sign and encrypt messages. Anyone with any name can join the ...
3
votes
2answers
2k views

Proof of security for RSA signatures

I am new to here, I was having some problems with a problem I am working on: "For each of the following variants of the definition of security for signatures, state whether textbook RSA is secure ...
3
votes
1answer
2k views

Demonstrating the insecurity of an RSA signature encoding scheme

I'm working on problem 12.4 from Katz-Lindell. The problem is as follows: Given a public encoding function $\newcommand{\enc}{\operatorname{enc}}\enc$ and a textbook RSA signature scheme where ...
3
votes
1answer
188 views

What is the probability of attacking SHA1 used in RSA signature with small exponent?

There is RSA signature check which has following properties: RSA modulus N which is 2048-bit RSA public exponent equal 41 (0x29) Genuine Signature uses EMSA-PKCS1-v1_5 padding of SHA1 hash, however ...
3
votes
1answer
100 views

Why is padded RSA not CCA-secure?

Why is the padded RSA construction given in the picture not CCA secure?
3
votes
2answers
127 views

Can RSA (theoretically) be used as a block cipher?

Assume AES gets a devastating attack making it unusable. Is it possible to use RSA in a secure way that can encrypt data in bulk? I can't see how RSA (assuming OAEP padding) can be used in normal ...
3
votes
1answer
292 views

Why not use OAEP for signatures?

There seems to be a distinct lack of implementations of RSA signatures using OAEP to pad the digest. Other than the old, funky, padding schemes, it's PSS all the way. PSS seems to have the whiff of ...
3
votes
1answer
94 views

How to understand RSA Proofs of correctness at Wikipedia

From Wikipedia(https://en.wikipedia.org/wiki/RSA_%28cryptosystem%29#Proofs_of_correctness): $m^{ed}$ ≡ $m$ $\pmod{q}$ $m^{ed}$ ≡ $m$ $\pmod{p}$ then $m^{ed}$ ≡ $m$ $\pmod{pq}$ Question: if $m^{ed}$ ...
3
votes
1answer
188 views

Why don't use random padding in RSA?

Consider the following scenario: Sender S sends a message to receiver R. He uses a hybrid encryption scheme with RSA as key-encapsulation algorithm and AES-256-CTR (4byte-counter) and SHA256-HMAC. ...
3
votes
1answer
290 views

RSA public key recovery from signatures

Is it possible (how) to recover public (512 bit long) RSA key from multiple signatures having corresponding plain texts. Padding is not randomized. I need it to verify any future message comming from ...
3
votes
1answer
688 views

RSA Blind Signature Attack

In Information Security Class I learned a non-adaptive chosen ciphertext attack using "blinding" but I just can't follow the proof and therefore can't reconstruct it. From what I've found out, it ...
3
votes
1answer
151 views

Security Level Estimate when Cascading/Compositing Ciphers?

Way back when, DES had a theoretical security level 56-bits. 2-key TDEA provides about 80-bits of security, and 3-key TDEA provides about 112-bits of security. Obviously, those security levels are not ...
3
votes
1answer
3k views

Is it true for Java that the transformation mode and padding is ignored when using RSA?

Consider GregS's comment to this question (more specific to bouncycastle's provider implementation): http://stackoverflow.com/questions/11717646/bouncycastle-rsa-key-size-and-padding The mode, ...
3
votes
1answer
465 views

Appropriate AES key length for short term protection

Currently I'm doing some initial research for a fully connected distributed network communication model. The context here is a peer-to-peer multiplayer protocol, using a majority-voting system. More ...
3
votes
1answer
717 views

How difficult is it to brute force d in RSA: d = (1/e) mod φ in a CPT attack?

Given that RSA key generation works by computing: n = pq φ = (p-1)(q-1) d = (1/e) mod φ If I was an attacker who wanted to brute force d, could I brute force d given just the public key, the ...
3
votes
1answer
664 views

Can you identify the public key used to encrypt something?

If I encrypt a string with a public key, does the encrypted ciphertext reveal the public key I used to encrypt it? Basically, I don't want anyone to know who the ciphertext is addressed to. I'm ...
3
votes
1answer
2k views

Secure encrypt-then-sign with RSA

I understand that when you want to encrypt and sign data with RSA the generally recommended approach is sign-then-encrypt. However, I have encrypted data that I need to sign, to prove the author of ...
3
votes
1answer
198 views

Is this attack for RSA possible?

$N=p·q$ ($p$ and $q$ are prime numbers), $m_1, ..., m_x$ are the messages, $e$ and $d$ are RSA encryption and decryption exponents, respectively. I am given $e, m_1, m_1^e, m_1^d, ..., m_x, m_x^e, ...
3
votes
2answers
4k views

How do digital certificates work, and why is it not possible to reverse engineer one from a signed file?

Digital certificates are used quite commonly these days, for signing files. They are used by various operating systems to ensure reliability and security. For example, Android requires that each of ...
3
votes
1answer
643 views

How are the primes used to generate RSA keys?

I am confused about how keys in RSA asymmetric encryption are generated and what the implications for open communications are. Textbooks say the one-way function is merely two primes (with some ...
3
votes
1answer
38 views

Is there a way to turn a PGP key into its semi-prime counterpart?

From my understanding of PGP keys they use the RSA algorithms to encrypt/decrypt messages. So, I know that the RSA algorithms use a semi-prime number to encrypt/decrypt messages. So, what I was ...