Tag Info

Hot answers tagged

4

The original poster clarified that: the application of RSA is signature (not encryption as originally stated); at least one signature $s$, the value of $N$, and $e=3$ are given; the signature is by signing an MD5 hash of a message, and a hash of the message matching the signature $s$ is also a given. The first, low-effort thing to do with the givens is ...


3

The Supersingular Elliptic Curve Isogeny Key Exchange that you refer to was first published in 2011 by DeFeo, Jao, and Plut. It builds on but is quite distinct from earlier work by Rostovetsev and Stolbunov in 2006. As a Post Quantum/Quantum Safe replacement for Elliptic Curve Diffie-Hellman (ECDH) it has several good properties: The number of bits that ...


3

Among several aspects of the question, I'll cover only protection against replay of commands. A common technique (among several) is to have commands tied to a nonce, that somewhat is accepted only once by the slave device receiving the command. The nonce is included in the input of a MAC or public-key signature algorithm that protects the integrity of the ...


3

I think I found an answer in this thread: http://www.gossamer-threads.com/lists/gnupg/users/65236 In short: There is a packet which looks like a key revocation but it could be forged. If an OpenPGP application downloads the key from the server then it does a signature check.


3

Suppose you have two message-signature pairs, $(m_1, s_1), (m_2, s_2)$, where $s_i = m_i^d \bmod n$. Suppose we also know the public exponent $e$—it is usually $65537$, $3$, $5$, $17$, or some similar small integer. Then we know that $m_i = s_i^e \bmod n$, or in other words $s_i^e = k_in + m_i$ and it follows that $\gcd(s_1^e - m_1, s_2^e - m_2) = \gcd(k_1, ...


2

On encrypting the same plain text, I get two different outputs. This is in fact a design goal of encryption systems: an adversary who sees two ciphertexts should not be able to tell whether they're equal — that would be an information leak. Even encryption systems that would otherwise be secure use an initialization vector or other similar unique value ...


2

Am I correct in assuming the above? No you are not. You are showing textbook/raw RSA, which is little more than modular exponentiation. To be secure RSA has to use padding methods. Without padding, RSA would indeed generate the same ciphertext each time. This alone would break the security requirements of a cipher. There are many other attacks on ...


2

Yes, in your specific case, $d=1031$ is the answer. You can check it in the following ways: Just try it out. Select some arbitrary messages, exponentiate with $e$, apply the modulus and exponentiate them with $d$. If this yields your original message number (like 20 or 5001) you know it's the correct $d$. Factor $N$ using the exponent. You may want to use ...


2

Since the time you asked your question some new algorithms have shown great promise. The first set of algorithms are based on the Learning with Errors Problem in over polynomial rings. See http://www.cc.gatech.edu/~cpeikert/pubs/suite.pdf There is also an elliptic curve scheme based around supersingular elliptic curve isogenies. There's a Wikipedia ...


2

You cannot encrypt a file with a private key. With RSA, that's not because of any technical obstacle (with other schemes private keys literally are not valid inputs to the encryption function), but because private keys are designated as "private" and using them in an encryption operation compromises the security of that message. To prove you wrote the ...


2

Designing such a challenge is Impossible. If we assume that having a connection is equal to being able to exchange any piece of knowledge at any given time then the proof of impossibility of such challenge is as follows: Proof. First assume that there is such a challenge and Alice is capable of querying such a challenge to correctly determine whether the ...


2

Here is a simple/laymans explanation of what the example is (most likely) about: Suppose you are given a new ciphering scheme (set of encryption and decryption algorithms) and you need to find out if it is secure. In cryptography, the security can be analyzed by issuing a challenge to the eavesdropper or adversary $A$. If the adversary wins the challenge, ...


1

It's not the algorithm that's more "efficient" (that's just a welcome side-effect) but the security level. Security levels are usually given in bits; to say that a cipher has 80 bits of security means that we assume it takes roughly $2^{80}$ effort to break it, for some definitions of "effort" and "break". For RSA, the main problem is factoring large ...


1

Expanding further on tylo's point regarding key management: when a user leaves the group, there is a need to create a new group key and distribute that to the remaining members. The most basic way to do this is for the server to first establish a session key with each user via a Diffie-Hellman or RSA key exchange in a manner similar to TLS, then use each ...


1

If you can recover the private key from a message and a signature (and the public key), then that signature method is broken, and broken quite bad. We believe that RSA, with a decent signature padding method, is secure, and hence the specific failure mode you mentioned cannot happen. There are two obvious ways to try to recover the private key for RSA; we ...


1

For completeness / posterity / future inquisitors, this is the response I got when I asked on the mailing list. I have also included it below because links sometimes break. No, you're not missing anything. This requirement is not, algorithmically, necessary. When you're decrypting with the symmetric key available, rsyncrypto uses the public key ...


1

Two approaches to Post Quantum Key Exchange that have acceptable bandwidth requirements are the NTRU/Ring-LWE lattice designs and the ECC Isogeny Key exchange you mention. Since the UK spy agency published an attack on a lattice based scheme they had designed, there has been an active discussion between Dan Bernstein and the Lattice Cryptographers over the ...



Only top voted, non community-wiki answers of a minimum length are eligible