# Tag Info

28

The answer is in the source, file sshrsag.c, line 9: #define RSA_EXPONENT 37 /* we like this prime */ This value $e=37$ matches the conditions for a reasonable fixed RSA public exponent: $e$ is odd, $e$ is at least $3$, $e$ is reasonably small. The later condition is good for speed of operations involving the public key (encryption, ...

11

Any $e$ such that $\gcd(e, (p-1)(q-1)) = 1$ will do. There is no need for it to be in the set $\{3,17,65537\}$; these last numbers are chosen for speed of encryption, mostly (two set bits leads to faster computation of modular exponentation), and these numbers happen to be prime, so the condiiton is easily checked. One often encounters other $e$, but many ...

8

You are looking at the ASN.1 encoding of private (and public) keys; the 00 values you see are an artifact of how ASN.1 encodes integers. ASN.1 is a method for describing data structures, and has ways to represents all sorts of data types. It wasn't designed with public keys (or cryptography) in mind; it was intended for more general use, initially ...

4

This protocol doesn't authenticate the mote at all. Consider this attack: Mote B sends a 'hello' message to Base. This message contains the ID# of Mote A and a random nonce [R] (HW generated) encrypted by the base's public key. Base decrypts the 'hello' and verifies the ID# against a whitelist. Base sends an 'ack' message. This message contains some ...

4

The method mentioned in the answer by Maarten will allow you to reduce the private key size for any public key algorithm by regenerating the key from a random seed, each time you need it. The drawback is the performance. Each time you need to use the key you need to spend as much CPU time for regenerating the key as you used for generating it the first ...

3

This is a really bad (and somewhat pointless) idea (if you do it on your own), because it provides less security than standard hashing and should only be considered if password escrow is a necessary feature. If you don't need the password escrow (= recover the password using the heavily secured airgapped private key) you can simply password-hash the password ...

3

In asymmetric crypto including RSA, we ALWAYS encrypt with the public key, and decrypt with the private key (NEVER the other way around). In the question, what's wanted is to sign with the private key, not encrypt. And that's enough to solve the whole problem, since RSA signature schemes exposed in BouncyCastle or the Java crypto API allow to sign data of ...

3

The requirement was introduced in IUT Recommendation X.509 (November 1993), informative appendix D.5.2: It must be ensured that e > log2(n). If not, then the simple operation of taking the integer eth root of a ciphertext block will disclose the plaintext. This advice was removed in the 2000 edition of the standard. It is arguably misguided, and at the ...

3

Yes, RSA is an example of a cryptosystem where this is possible. The message is encrypted using the recipient's public key only and even the sender could not decrypt it. However, in the comments you mention that you would like to minimize storage requirements. RSA would require e.g. 2048 bits for just the message. In comparison, with ECIES sending a ...

3

The adversary clearly can do that. But if the adversary wins with this strategy, then the scheme in question cannot even be CPA secure and is far away from reaching the goal desired from CCA security. Recall, CCA security requires that even having access to a decryption oracle (for any ciphertext but the challenge ciphertext) does not help the adversary.

2

Yes, asymmetric encryption is slow compared to symmetric encryption. With symmetric ciphers, encryption and decryption speed can be several gigabytes per seconds on a common PC core; see these benchmarks. With RSA encryption, on comparable hardware, we are talking tens of thousands encryptions per second, and only few hundreds of decryption per seconds, ...

2

Generate a random symmetric key (for example an AES key). We will use it only once for this transmission, and call it the session key. encrypt the session key with the public key encrypt the message with the session key forget the session key transmit the two encrypted message to the recipient Since you are using a whole new encryption key for every ...

2

If you use a deterministic encryption algorithm (so that you can actually verify passwords without the private key) it basically works like a backdoored hash. An attacker will be able to use a brute force or dictionary attack normally. One obvious problem with any reversible encryption is that it reveals (at least something about) the password length. (E.g. ...

1

Yes. You can use RSA for both signatures and encryption, but you need different algorithms for that. E.g. RSAES-OAEP is an encryption algorithm, while RSASS-PSS is a signature algorithm. Both use the RSA cryptosystem and have similar keys, but otherwise the algorithms differ. Textbook RSA has the "same" algorithm for both but is not secure. There are ...

1

$d$ must indeed be an integer. To calculate $d$ you need to calculate $d=e^{-1}\bmod{\phi(n)}$ which is called the modular multiplicative inverse of $e\bmod{\phi(n)}$. For $d$ be computable you need to ensure that $$\gcd(e,\phi(n))=\gcd(e,(p-1)(q-1))=1$$ holds, which isn't the case with your sample parameters as $\gcd(3,60)=3\neq1$. As fgrieu pointed out ...

1

See https://en.wikipedia.org/wiki/RSA_%28cryptosystem%29 Under Key Generation: Compute n = pq. n is used as the modulus for both the public and private keys. Its length, usually expressed in bits, is the key length.

1

This sounds like Kerberos. ( https://en.wikipedia.org/wiki/Kerberos_%28protocol%29 ) In any case, you didn't mention, but it would seem quite important, how long are the generated auth tokens valid for, or how would you expire one. There is no such thing (IMHO) as permanent/indefinite authorization--if you believe otherwise, you should not be doing ...

1

The size of the public key depends on the elliptic curve used. Any private key will produce a point on the curve, which is the same size – approximately 256 bits for 256-bit curves, for example. Random numbers from a small range could be insecure, however. The secure way to generate the private key is to take it from the range $[1, l-1]$, where $l$ is the ...

1

MIGJAoGBAKv4...................3VpXAgMBAAE= 30818902818100 ABF8... ...DD5A57 0203010001 7 5 Overhead & public exponent are 7 + 5 = 12 bytes. You have a 1024 bit modulus = 128 bytes. So a correct encoding would be 12 + 128 = 140 bytes, requiring ceil(140 / 3) = 47 * 4 = 188 base 64 characters. You however ...

1

To expand on Ricky's comment, assuming Alice and Bob are the only participants, they can use an identity-based encryption scheme where Alice also acts as the trusted third-party ("Private Key Generator" in the Wikipedia article). Namely: Alice puts on her PKG hat, and generates the public parameters of the system and a secret which will be used later. ...

Only top voted, non community-wiki answers of a minimum length are eligible