Tag Info

Hot answers tagged

10

It is feasible to generate 300 million public key pairs of reasonable strength in 8 hours on a single computer, easily with ECDSA using a single core/thread, and even with DSA using quite a common multi-core computer. RSA would require many standard computers (baring hardware accelerators for modular exponentiation), assuming all the public keys are made ...


8

For RSA, the answer whether it is feasible for a single computer depends on the reason your generating them (and specifically, whether they need to remain secure if you publish a number of them). For example, if you're generating the RSA keys to search for some criteria (e.g. the hash of the public key has a specific pattern), and you'll discard the ones ...


4

First, let me address the assumption that private keys will be found in a few years using a fast computer. Unless there are serious algorithmic improvements in the cryptanalysis of a scheme, this simply is not true. Of course, the length of the key is of importance, and if you need security for the far future then you should be using 4096-bit keys (or even ...


4

Decoding information within a time frame is of absolute importance. Say xyz is an terrorist, the information of his attack will be useful today, not years after the attack has happened. And similarly decoding your message is important today, not years later. also there might be a possibility that when somebody has decoded your key for future use, you might ...


4

No, we do not know an algorithm running in linear time (or even polynomial time, relative to the number of digits in $n$) that outputs 'true' if $n$ is the product of exactly two prime numbers, and 'false' otherwise. If such an algorithm existed, I do not see that it would imply possibility to factor $n$, or otherwise break RSA. For sure, it would not be a ...


3

Some background on formal key-exchange models The goal of a key-exchange (KE) is to establish a session key between two parties. Naively, we could say that a KE is secure if no adversary will be able to figure out the session key (in full) established between two honest parties. However, in formal security models we take this a bit further and insist that ...


3

What is stopping someone from saving encrypted info, and decoding it later? Nothing. That's exactly why certain three letter institutions build large data centers... Waiting for the first large quantum computer to be built or for new attack techniques that allow to break e.g. RSA for the key sizes used today. Are there any time-sensitive safeguards ...


3

Signing and encrypting together is not secure in this method, at least in the way most would perceive security. For example, Bob would likely interpret this message as being sent from Alice to Bob. However, Alice may have sent it to Charles who decrypted and re-encrypted the signed message under Bob's public-key. In order to do this securely, you need to add ...


2

Instead of trying to invent your own protocol, you'd be much better off using something that is already out there. For example, you could use TLS to transport the data. Another option would be to use GnuPG and some other transport mechanism (post the file on a website to be downloaded by Bob, send it via email, etc). Now, to your question of does this ...


2

Essentially any IND-CPA-secure lattice-based cryptosystem offers additive homomorphism, up to a predetermined number of operations. I don't know of any IND-CCA1-secure post-quantum candidate that offers any homomorphic property, except Loftus-May-Smart-Vercauteren SAC'11, which is based on a nonstandard "knowledge of error" lattice assumption.


2

I further assume you mean a DER-encoded unencrypted PKCS#8 RSA key, since you wouldn't care about exposing an encrypted key, and it's a conventional two-prime key with equal-size factors (each 1024 bits) and the ubiquitous e=65537 using the standard PKCS#1 CRT-form representation. I also note that 21 bits is a really odd amount to disclose: not 2 octets, ...


1

Edwards curves can be implemented using a unified formula for addition and doubling; i.e., one can implement addition such that $$\mathrm{dbl}(P)=\mathrm{add}(P,P).$$ Performance wise it is however more efficient to consider both functions separately, since the doubling can be implemented more efficiently than the addition. Depending on the representation ...


1

There should be plenty of them. Off the top of my head, I'm thinking of the provable secure version of NTRU by Stehlé and Steinfeld [1], which is IND-CPA secure. In this scheme, ciphertexts are of the form: \begin{equation} c = pk \cdot s + p\cdot e + \operatorname{encode}(m) \end{equation} where $s$ and $e$ are random polynomials, $p$ is a small prime, ...


1

TL;DR: use (D)TLS. This is exactly the kind of problem it was meant to solve. If possible, use cert pinning too (if you get to deploy the code on both ends of the channel, this should be possible). The general rule is: don't design your own crypto protocol unless both of the following apply. You have done a detailed review of what exists already and ...


1

Let's assume that the leaked bits were from the "actual" private key, i.e. the primes $p$, $q$, the private exponent or its value modulo one of the primes. A Coding-Theoretic Approach to Recovering Noisy RSA Keys gives a bound of 20% of the key material needing to be known for an attack. Given that you have a 2048-bit key, I don't think leaking 21 bits ...


1

Steps 5 and 7 remain very important even when one ignores DoS attacks. $\;\;\;$ The RSA key-pairs use ​ e = 3 $\;\;\;$ Server signs $\: \langle \hspace{-0.03 in}$ RSA_modulus , RSA_ciphertext $\rangle \:$ and returns that to Client in step 3 $\;\;\;$ If computation is significantly more of a bottleneck than communication, $\;\;\;$ then Client computes ...


1

Yes, this is possible. One possible argument is of algebraic nature, using the fact that there is some $a\in\{0,\dots,q-1\}$ with $g_2=g_1^a$ and rewriting the public key's defining equations using this relation. However, there's a much simpler justification: A Cramer-Shoup public key consists of five elements $g_1,g_2,c,d,h$ of a group of order $q$, hence ...



Only top voted, non community-wiki answers of a minimum length are eligible