an asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption.
0
votes
0answers
7 views
Verify Signature Failed
I am writing a small module which will verify signed message.
Message will be signed using private key in Smart Card.
Inputs are
1> Signed Message
2> Original Message
3> Public Key / ...
2
votes
1answer
71 views
low-exponent RSA
I have questions from http://link.springer.com/chapter/10.1007%2F3-540-68339-9_1
Suppose we have 2 messages $m_1$ and $m_2$ related by a known relation $m_2=m_1+1$.
Suppose further the messages are ...
2
votes
1answer
126 views
Cracking an RSA with no padding and very small e
I have a project wherein I have to crack a given cipher text encrypted using RSA and have been given N and e. Can someone suggest an RSA attack using a very small exponent e(here e=3) and no padding?
5
votes
2answers
2k views
In RSA, do I calculate d from e or e from d?
In the original paper introducing RSA, it is implied that one should first choose $d$ and then calulate $e$ from $p$, $q$, and $d$. However, I have found in other places (such as the wikipedia article ...
0
votes
3answers
104 views
Amateur question: two-way RSA?
Is this a sensible scheme for 2-way client/server communication? A client connects to a server. The server and client both generate RSA keys, and send over the public ones to each other. If the client ...
0
votes
1answer
80 views
Preimage resistance hash in digital signature
I'm studying about preimage resistance property of the hash functions.
In particularly I'm reading as the missing of this property can be fatal in digital signatures that use RSA.
Further details:
...
0
votes
0answers
59 views
Why is it impractical to generate a semiprime dictionary? [duplicate]
This might be a very simple question. However, I am just learning the concept, so just excuse me.
I am wondering why there is not any attempt to generate all semiprime numbers? (as an dict. attack to ...
2
votes
1answer
84 views
Given a private RSA key, how do we get the public key?
Is it possible to pre-choose a private RSA key, then obtain a public key from it?
-1
votes
1answer
47 views
How to choose the appropriate public (i, m) and private (j, m) keys?
I studied some encryption and decryption and I have found some very interesting problem to solve on the internet. I hope I am writing to right site - there are so many in StackExchange otherwise I ...
4
votes
1answer
116 views
Security strength of RSA in relation with the modulus size
NIST SP 800-57 §5.6.1 p.62–64 specifies a correspondence between RSA modulus size $n$ and expected security strength $s$ in bits:
...
1
vote
1answer
79 views
What kind of cryptography should i use?
I have a trusted third part A that issues an access token (xml file) to an untrusted client C that uses this token to log into an untrusted server S and access to the authorized files.
I want only ...
3
votes
3answers
61 views
What are some good references for the implementation weaknesses in RSA
I'm pretty sure I understand textbook RSA.
Choose p and q, large primes, and compute n=pq.
Choose e such that $gcd(\phi(n),e)=1.$
Publish n and e.
Compute d such that $de=1$ (mod $\phi(n)$).
To ...
2
votes
1answer
82 views
Can you identify the public key used to encrypt something?
If I encrypt a string with a public key, does the encrypted ciphertext reveal the public key I used to encrypt it? Basically, I don't want anyone to know who the ciphertext is addressed to.
I'm ...
37
votes
3answers
18k views
Why is elliptic curve cryptography not widely used, compared to RSA?
I recently ran across elliptic curve crypto-systems:
An Introduction to the Theory of Elliptic Curves (Brown University)
Elliptic Curve Cryptography (Wikipedia)
Performance analysis of identity ...
0
votes
1answer
83 views
How long to bruteforce a RSA key
Suppose I have a 2048 bit RSA public key, and want to brute force the corresponding private key. I guess there are 2048^16 possible combinations?
How long would this take me to brute force with an ...
-2
votes
2answers
87 views
Is triple des similiar to RSA in that they message size is limited to the key size?
Is triple des similiar to rsa in that the message size you can encrypt is limited (unlike AES)?
Yes you can break the message size into parts and apply it, but I'm not interested in doing that so I ...
13
votes
1answer
299 views
What security authorities and standards reject $e=3$ in RSA, when, and with what rationale?
In RSA, some security authorities and/or standards allow the public exponent $e=3$, others require or recommend $e>2^{16}$ (or perhaps some other minimum). I gathered the following:
PKCS#1 allows ...
4
votes
1answer
162 views
What do recent announcements about solving the DLP in $GF(2^{6120})$ mean for RSA
After just reading the post Do recent announcements about solving the DLP in $GF(2^{6120})$ apply to schemes proposed for cryptographic use?
I was a bit confused. DSA, ElGamal and others are based on ...
1
vote
1answer
42 views
When making public key fingerprints - is a sha1 hash still a good idea?
I'm thinking about trying to save some space (and readability) when referencing 2k and 4k public keys (millions of them) by storing the fingerprint in some places instead of the full public key.
...
2
votes
3answers
171 views
If RSA is limited to 117-200 bytes or so, is that a very limited use case?
Am I missing something, or is RSA very very limiting when it comes to ecrypting data when it comes to the actual message size?
I have read that you can only encrypt a message of around 117 to 200 ...
1
vote
1answer
54 views
How is text converted to a number for RSA?
According to http://en.wikipedia.org/wiki/RSA_%28algorithm%29#Key_generation the key length is the number of bits in n. So how can a message of many megabytes (millions of bits) be modded by a 1024 ...
0
votes
0answers
50 views
RSA vs El Gamal digital signature. Which is more secure?
I'm reading about the notions of security concerning digital signatures and I can't understand whether RSA is more secure than El Gamal digital signature. Well, they are both prone to forgery, but I ...
2
votes
1answer
106 views
Why is verification using DSA slower than verification with RSA?
We read in literature that verification of a digital signature is slower using DSA than if we used RSA. Why is this?
DSA parameter generation:
choose prime number $p$
choose prime number $q$ such ...
2
votes
2answers
214 views
Why RSA uses {d,n} as private key instead of {e,n}?
While studying the RSA algorithm I referred to some books and some sites such as RSA (wikipedia) and all of them chose {d,n} as the secret (private) key and release {e,n} as the public key but as d ...
-3
votes
0answers
76 views
RSA decryption from ciphertext using private key [closed]
I am sniffing a client side application traffic and I found some encrypted data. I am not able to decrypt it. Information which I have is
Public Key:
...
0
votes
2answers
132 views
Physical Level Encryption
What types of algorithms that are capable of signing a message are out there that run on a physical level, e.g. lacking the infrastructure of a standard PC, no memory, processor or motherboard in the ...
2
votes
1answer
108 views
How does OAEP improve the security of RSA?
The heart of OAEP algorithm used for RSA encryption are the cryptographic hash functions $H$ and $G$.
Does everybody (so also an adversary) know these functions?
If YES: How does it help the ...
20
votes
10answers
2k views
Now that quantum computers have been out for a while, has RSA been cracked?
D-wave systems has released a commercially viable quantum computer. This means; in theory, that all asymmetric encryption algorithms, such as RSA are now useless, due to the speed at which quantum ...
1
vote
2answers
97 views
Why is the following RSA PRNG cryptographically secure?
One requirement states that the generator has to withstand the next-bit test.
Consider the following PRNG, where we calculate next output $x_i$ via the formula
$x_i = x_{i-1}^ e\mod n$.
I can see ...
6
votes
2answers
184 views
RSA leak bits to factor N
Suppose you randomly generate large primes p and q as in RSA, and then tell me N=pq but not p or q.
Then, you would like to actually let me factor N, except you should tell me as few bits of ...
-1
votes
1answer
92 views
What length should the padding be when encrypting or signing with RSA?
Does it matter what length the padding is? If so - what length should it be?
(Another point: Should it be random?)
1
vote
2answers
532 views
Decrypt digital signature using RSA public key with openssl
I have a digital signature that was created using the following algorithm: a SHA-256 hash of the body of the message is calculated. It is then signed using an RSA private key and the result is ...
3
votes
1answer
166 views
Secure encrypt-then-sign with RSA
I understand that when you want to encrypt and sign data with RSA the generally recommended approach is sign-then-encrypt.
However, I have encrypted data that I need to sign, to prove the author of ...
5
votes
1answer
116 views
Proof that padded RSA is CPA-secure
I'm referring to page 383 of J. Katz and Y. Lindell's Introduction to Modern Cryptography. The book presents a padded RSA:
${\bf Key Generation:}$ same as Textbook RSA (given security parameter ...
0
votes
1answer
51 views
chaining rsa with ecies
In an answer to a previous question it was suggested that one way to protect your asymmetrically encrypted AES-256 keys, from say a solution to prime factorization, would be to chain asymmetric ...
1
vote
2answers
123 views
risk of attacker decrypting RSA ciphertext without public or private key
As I describe in my previous question I am trying to decide if it's worth it for me to use the Offline Private Key Protocol in creating some long term private archives, instead of just going with a ...
0
votes
1answer
50 views
Certificate == signed public key
For primes p and q used to create a keypair, I understand that the following operation is used to create a signature :-
M ^ d (mod N)
where d and N have their usual meanings and M is the message. In ...
0
votes
1answer
99 views
RSA - Ecrypting the same data with the same public key = same ciphertext?
If an adversary knows my public key and guesses what was my plaintext, can he test for it somehow?
The most obvious way is encrypting the guessed plaintext with my public key and the same parameters ...
3
votes
1answer
85 views
implementing long term archive encryption
Let's say I want to create private archives for the long term (e.g. more than 30 ). The archives' sizes could be anywhere from 1 GB to 30 GB. As far as I understand I could go down two ways:
The ...
2
votes
4answers
203 views
Tamper-proofing log files
Problem Overview
I want to securely store log files so the contents are secret, and they can't be modified without detection.
The files will be encrypted using authenticated encryption (AES in GCM ...
5
votes
1answer
131 views
In textbook RSA with low public exponent, how big does a random message needs to be?
Assume RSA with a public modulus $N$ of $n$ bits, a small odd public exponent $e$, plaintext $M$ a random non-negative integer less than $2^m$ for some integer parameter $m$, with $M\mapsto C=M^e\bmod ...
3
votes
1answer
120 views
Combining AEAD with RSA
'Hybrid' encryption, where we combine symmetric encryption with public-key cryptography, is pretty 'tried and tested'.
To summarise, we generate a symmetric key and encrypt it using RSA. We would ...
10
votes
8answers
904 views
RSA with small exponents?
Just to establish notation with respect to the RSA protocol, let $n = pq$ be the product of two large primes and let $e$ and $d$ be the public and private exponents, respectively ($e$ is the inverse ...
2
votes
2answers
132 views
Chain several RSA encryptions without increasing the message size
I would like to be able to encrypt the output of RSA with RSA again without having the output grow in size over time.
In other words, I have some data $D_0$ which I want to encrypt with RSA: $D_1 = ...
2
votes
1answer
198 views
Extract private RSA key from USB cryptographic token using Bardou et al. attack (varian of “million message attack”)
There is a side channel attack on tamper-resistant USB cryptographic tokens using padding-oracle, described by Bardou, Focardi, Kawamoto, Simionato, Steel and Tsay, titled "Efficient padding oracle ...
5
votes
0answers
156 views
Prove that textbook RSA is susceptible to a chosen ciphertext attack
Given a ciphertext $y$, describe how to choose a ciphertext $\hat{y} \neq y$, such that knowledge of the plaintext $\hat{x}=d_K(\hat{y})$ allows $x=d_k(y)$ to be computed.
So I use the fact that the ...
1
vote
1answer
67 views
How to learn the first bit of m in padded RSA
Consider the following version of padded RSA encryption, where encryption of $m$ is done by setting $m′ = (0^k~||~r~||~00000000~||~m)$ for a random $r$ (of length 8 btyes = 64 bits) and then computing ...
1
vote
1answer
55 views
Comprehension question on a signature protocol based on the RSA assumption
We have the following two-party protocol between Alice and Bob. Alice sends messages $m_1, m_2, \ldots \in_R \mathbb{Z}_n^*$ to Bob and Bob signs these values by calculating $v_1, v_2, \ldots \in_R ...
9
votes
3answers
2k views
What is the relation between RSA & Fermat's little theorem?
I came across this while refreshing my cryptography brain cells.
From the RSA algorithm I understand that it somehow depends on the fact that, given a large number (A) it is computationally ...
1
vote
2answers
192 views
What data is saved in RSA private key?
What data is saved in RSA private key in openssl? How to view it?
Wikpedia says these variables are saved.
