# Tag Info

16

This is a common mistake, so I'd like to give an in-depth answer. Basically, what you are proposing is to rely on the ONE-WAYNESS of RSA as a ONE-WAY FUNCTION, rather than relying on its CPA or CCA security as an encryption scheme. The advantage of using RSA as a one-way function is that no padding etc is needed. Now, the first important thing to note is ...

4

@Erez points to the simple and often good enough solution. In more general terms, you want to split the private key knowledge into several "shares" such that all of them are needed to actually obtain the private key. This calls for a few comments: To make the splitting/sharing easier, you can do things indirectly: generate a random symmetric key K, encrypt ...

3

The obvious answer is symmetric keys. You'll find that this is actually what asymmetric keys end up used for, exchanging symmetric keys. If you trust someone who gives you a key, and you can trust that no one else has it, that's about as secure as it gets. The difficult of satisfying those requirements is why we have asymmetric keys.

3

It should be proven in any presentation of RSA that, with a correct public modulus $N$, public exponent $e$ and private exponent $d$, all integers $m \in \{0,1,\dots,N-1\}$ satisfy $$\left(m^e\bmod N\right)^d\bmod N = m.$$ So it is only possible for a number to "not encrypt or decrypt correctly" when it is not in $\{0,1,\dots,N-1\}$. Moreover, this necessary ...

2

You are looking for a secret sharing algorithms. Such schemes are used in products such as PGP, originally Shamir offered a solution, called Shamir's secret sharing algorithm.

2

The tests you can do depend on how much time you want to spend for checking each certificate and the "stupidity" you assume for the given key-owner. You already mentioned the basic checks: Modulus is too small, only interesting if it's smaller than 1024 bits Exponent is unusual, not exactly a vulnerability in most cases The following attacks may take ...

2

What you are describing is called $(t,n)$-threshold signature, where you need at least $t$ parties (out of a total of $n$) to create a signature. Considering your description, it seems that in your case $t=n$, so it is necessary that all the keys are used for creating the signature. This answer assumes that you want to verify the signature with a single ...

1

I'm going to describe two options that you have. There may be more that I don't know about. The first is to use long-term signing keys to sign public diffie-hellman keys. Upload a bunch of those to the cloud. Then when someone wants to share a file with you, they: download your "next" signed public diffie-hellman key verify the signature using OpenPGP, ...

1

Steps 5 and 7 remain very important even when one ignores DoS attacks. $\;\;\;$ The RSA key-pairs use ​ e = 3 $\;\;\;$ Server signs $\: \langle \hspace{-0.03 in}$ RSA_modulus , RSA_ciphertext $\rangle \:$ and returns that to Client in step 3 $\;\;\;$ If computation is significantly more of a bottleneck than communication, $\;\;\;$ then Client computes ...

1

Yes, this is possible. One possible argument is of algebraic nature, using the fact that there is some $a\in\{0,\dots,q-1\}$ with $g_2=g_1^a$ and rewriting the public key's defining equations using this relation. However, there's a much simpler justification: A Cramer-Shoup public key consists of five elements $g_1,g_2,c,d,h$ of a group of order $q$, hence ...

1

No, this is not possible. The homomorphism only works at one layer. A ciphertext in Paillier is $g^m\cdot r^n\bmod{n^2}$. The plaintext space is the multiplicative group of integers modulo $n$. So, for it to even have a chance to work, first of all, the modulus of the outer encryption would have to be greater than $n^2$, where $n$ is the modulus of the ...

1

No, Paillier is not commutative. Your proposal for doing oblivious decryption is almost correct. Multiplication in the ciphertext domain is addition in the plaintext domain, so $E(pk, m+r) = E(pk, m) \cdot E(pk, r)$. Given $m+r$ in a finite group, Bob cannot figure out $m$ as long as $r$ is only ever used once.

1

$\big(\hspace{-0.03 in}$You don't need that. $\:$ $\operatorname{L}\hspace{-0.02 in}\operatorname{cm}\hspace{.02 in}(\hspace{.04 in}p\hspace{-0.04 in}-\hspace{-0.05 in}1,\hspace{-0.02 in}q\hspace{-0.04 in}-\hspace{-0.05 in}1)$ can be used instead of $\phi(N)$.$\hspace{-0.03 in}\big)$ $k$ is an integer which will make the quotient an integer. ...

Only top voted, non community-wiki answers of a minimum length are eligible