# Tag Info

7

Selecting a small $d$ is known to be insecure. Wiener has shown in 1990 that if $\log d \leq \frac14 \log N$, the private exponent $d$ can be reconstructed from the public key $(N,e)$. If you're interested in making the private computational cost cheaper, then I would suggest that RSA is not the best solution; I would recommend you start looking at ...

5

How do we keep $\phi(n)$ secret? We don't tell people what it is. The problem of finding $\phi(n)$ given $n$ is a hard problem (if $n$ is hard to factor). So, if we give people a number that they can't factor, and we don't give them $\phi(n)$, they can't determine it on their own.

3

Yes, we need symmetric cryptosystems, for many reasons; to give three of these: We need a hash function to make most asymmetric cryptosystems secure (e.g. we simply do not have a secure signature system based on RSA without a hash), and current hash functions are (or are built from) symmetric cryptosystems. All asymmetric encryption cryptosystems are bound ...

3

The requirement is that your element $g$ is in $\mathbb{Z}_{n^2}^*$ and not in $(\mathbb{Z}_{n}^*)^2$. The set $\mathbb{Z}_{n^2}^*$ is the set of integers smaller than $n^2$ that are relatively prime to $n^2$, i.e., you require an element $g$ from $\mathbb{Z}_{n^2}$ such that $\gcd(g,n^2)=1$. $(\mathbb{Z}_{n}^*)^2$ on the other hand is the set of pairs ...

2

As already mentioned in a previous comment, ECIES (a hybrid encryption scheme) is typically the way to go when implementing asymmetric encryption on elliptic curves, as it is standardized. It provides chosen ciphertext security (IND-CCA). But as you are looking for "pure" public key encryption schemes, here we go: ElGamal can not only be implemented in ...

2

Okay. So first up, let's eliminate encrypt-then-sign. Why is this a problem? The idea behind a signature is to prove that a message came from me even in the presence of malicious actors. If a malicious actor changes the ciphertext under the signature, clearly this invalidates the signature as per expectations, however, that is only one possible attack ...

1

Scroll to the end for tl;dr. Regarding your contrived example: Alice doesn't have Bob's keypair, but sends a message in such a way that only Bob can read it, eg. puts it in a dead-drop. So she takes out her pen and writes Hey Bob, could you sign and send me $X$ along with your public key? Here's mine: $P_A$ Signed, Alice Bob has no way of knowing if ...

Only top voted, non community-wiki answers of a minimum length are eligible