Hot answers tagged public-key
7
The $1^k$ is a formalism that's only there to make the theoreticians happy. You can safely ignore it. When you actually implement the cryptosystem, you don't try to pass the string $1^k$; instead, you pass $k$, the security parameter (a representation of how much cryptographic strength is desired from the key generation algorithm).
I wish I could leave it ...
5
Well, yes, everyone (or, at least, everyone who can use the public key) knows the hash function H and G; so we can assume that an adversary knows them as well.
You ask:
If YES: How does it help the security, if he just can decode
the padding and read the message?
Well, he can't decode the padding; the ciphertext has been encrypted using RSA, and he ...
3
The main pitfall is possibly thinking that it provides authentication.
The result is still a public key scheme.
It won't help to include the IV in the associated data, since
that is already covered by the authenticated part of AEAD.
Including the RSA-encrypted symmetric key in the associated data would help by making the
resulting hybrid encryption CCA2 ...
3
When we say "RSA is broken" do we mean that a practical attack is discovered to retrieve the private key from the public, or do we mean that given a ciphertext and no knowledge of either the private or the public key the attacker can decrypt the data?
First off, we always assume the attacker has the public key. Someone saying "RSA is broken" could mean ...
3
Without an out-of-band channel, no.
If all Alice has only a public key , she can't tell the difference between Bob's key and Mallory's. Hence Mallory can mount a man in the middle attack.
To prevent this you either need a certificate or a a trusted out of band channel though which you conform the key. The channel could be something that is harder to man ...
3
This result is proven in the following research papers:
Johan Hastad, Mats Naslund. The Security of all RSA and Discrete Log Bits. Journal of the ACM, Oct 2003, pp.1--45.
W. Alexi, B. Chor, O. Goldrech, C. Schnorr. RSA and Rabin functions: Certain parts are as hard as the whole. SIAM Journal on Computing, vol 17 no 2, pp.194--209.
They show that if ...
2
Bitcoin doesn't use RSA, it uses ECDSA. Every 256-bit value is a valid private key. (Though a very small fraction of them have to be folded.)
But even if the numbers had to be special, it still wouldn't matter. You could use every 256-bit value as a seed to a pseudo-random number generator which you could use to deterministically generate numbers that had ...
1
It's hard to be sure without seeing a bit more context, but the paragraph you quoted looks like it's part of a definition of IND-CPA security (ciphertext indistinguishability under a chosen-plaintext attack) for public-key ciphers.
Here's the corresponding definition from the Wikipedia article I linked to above:
"For a probabilistic asymmetric key ...
1
Thinking a bit about your problem, you could potentially strengthen it by chaining key encryption algorithms. Using two-phase encryption (a symmetric algorithm like AES-256 protecting the data, and an asymmetric algorithm like RSA protecting the key) exposes you to weakness in either AES or RSA. You could attempt to strengthen the key protection by adding ...
1
The primary problem with encrypt-then-sign (signing the ciphertext) relates to the difference between signing for the purpose of assigning responsibility vs for the purpose of taking credit. Encrypt-then-sign is OK for the former but not for the latter. The issue is quite subtle.
In particular, in your protocol, the recipient has no reason to believe the ...
1
http://security.stackexchange.com/questions/25170/what-information-is-leaked-from-an-openpgp-encrypted-file ${\color{white}{This text is supposed to be white, and will hopefully be enough to keep it here rather than being made into a comment.}}$
1
Well, each party would know that the other party uses the same key, because they would probably have the same public key.
Now, if some person I have never met before would use the same key as me, I would go into paranoid panic mode. That person could decrypt all messages that were only meant to be decrypted by me (and of course vice versa).
However, if I ...
Only top voted, non community-wiki answers of a minimum length are eligible
