# Tag Info

## Hot answers tagged public-key

16

This is a common mistake, so I'd like to give an in-depth answer. Basically, what you are proposing is to rely on the ONE-WAYNESS of RSA as a ONE-WAY FUNCTION, rather than relying on its CPA or CCA security as an encryption scheme. The advantage of using RSA as a one-way function is that no padding etc is needed. Now, the first important thing to note is ...

4

@Erez points to the simple and often good enough solution. In more general terms, you want to split the private key knowledge into several "shares" such that all of them are needed to actually obtain the private key. This calls for a few comments: To make the splitting/sharing easier, you can do things indirectly: generate a random symmetric key K, encrypt ...

3

It should be proven in any presentation of RSA that, with a correct public modulus $N$, public exponent $e$ and private exponent $d$, all integers $m \in \{0,1,\dots,N-1\}$ satisfy $$\left(m^e\bmod N\right)^d\bmod N = m.$$ So it is only possible for a number to "not encrypt or decrypt correctly" when it is not in $\{0,1,\dots,N-1\}$. Moreover, this necessary ...

3

The obvious answer is symmetric keys. You'll find that this is actually what asymmetric keys end up used for, exchanging symmetric keys. If you trust someone who gives you a key, and you can trust that no one else has it, that's about as secure as it gets. The difficult of satisfying those requirements is why we have asymmetric keys.

2

You are looking for a secret sharing algorithms. Such schemes are used in products such as PGP, originally Shamir offered a solution, called Shamir's secret sharing algorithm.

2

The tests you can do depend on how much time you want to spend for checking each certificate and the "stupidity" you assume for the given key-owner. You already mentioned the basic checks: Modulus is too small, only interesting if it's smaller than 1024 bits Exponent is unusual, not exactly a vulnerability in most cases The following attacks may take ...

2

What you are describing is called $(t,n)$-threshold signature, where you need at least $t$ parties (out of a total of $n$) to create a signature. Considering your description, it seems that in your case $t=n$, so it is necessary that all the keys are used for creating the signature. This answer assumes that you want to verify the signature with a single ...

1

$\big(\hspace{-0.03 in}$You don't need that. $\:$ $\operatorname{L}\hspace{-0.02 in}\operatorname{cm}\hspace{.02 in}(\hspace{.04 in}p\hspace{-0.04 in}-\hspace{-0.05 in}1,\hspace{-0.02 in}q\hspace{-0.04 in}-\hspace{-0.05 in}1)$ can be used instead of $\phi(N)$.$\hspace{-0.03 in}\big)$ $k$ is an integer which will make the quotient an integer. ...

1

I'm going to describe two options that you have. There may be more that I don't know about. The first is to use long-term signing keys to sign public diffie-hellman keys. Upload a bunch of those to the cloud. Then when someone wants to share a file with you, they: download your "next" signed public diffie-hellman key verify the signature using OpenPGP, ...

1

If by authenticated encryption we mean encrypt-then-MAC then that provides some mitigation against side channel attacks - timing, error responses etc - because it allows you to detect that the message has been tampered before you start decrypting it and in something hopefully close to constant time. It is perhaps worth mentioning that in TLS the opposite ...

1

I suggest that you look at Signcryption; a short survey appears here, and efficient schemes appear here. Just signing then encrypting or vice versa in a naive way is not secure (especially in the multi-user setting). So you have to do this right. Once you have a concrete scheme, you then have to see what level of security the encryption scheme needs to be. ...

Only top voted, non community-wiki answers of a minimum length are eligible