# Tag Info

28

The answer is in the source, file sshrsag.c, line 9: #define RSA_EXPONENT 37 /* we like this prime */ This value $e=37$ matches the conditions for a reasonable fixed RSA public exponent: $e$ is odd, $e$ is at least $3$, $e$ is reasonably small. The later condition is good for speed of operations involving the public key (encryption, ...

11

Any $e$ such that $\gcd(e, (p-1)(q-1)) = 1$ will do. There is no need for it to be in the set $\{3,17,65537\}$; these last numbers are chosen for speed of encryption, mostly (two set bits leads to faster computation of modular exponentation), and these numbers happen to be prime, so the condiiton is easily checked. One often encounters other $e$, but many ...

3

The adversary clearly can do that. But if the adversary wins with this strategy, then the scheme in question cannot even be CPA secure and is far away from reaching the goal desired from CCA security. Recall, CCA security requires that even having access to a decryption oracle (for any ciphertext but the challenge ciphertext) does not help the adversary.

3

This is a really bad (and somewhat pointless) idea (if you do it on your own), because it provides less security than standard hashing and should only be considered if password escrow is a necessary feature. If you don't need the password escrow (= recover the password using the heavily secured airgapped private key) you can simply password-hash the password ...

2

If you use a deterministic encryption algorithm (so that you can actually verify passwords without the private key) it basically works like a backdoored hash. An attacker will be able to use a brute force or dictionary attack normally. One obvious problem with any reversible encryption is that it reveals (at least something about) the password length. (E.g. ...

1

$d$ must indeed be an integer. To calculate $d$ you need to calculate $d=e^{-1}\bmod{\phi(n)}$ which is called the modular multiplicative inverse of $e\bmod{\phi(n)}$. For $d$ be computable you need to ensure that $$\gcd(e,\phi(n))=\gcd(e,(p-1)(q-1))=1$$ holds, which isn't the case with your sample parameters as $\gcd(3,60)=3\neq1$. As fgrieu pointed out ...

Only top voted, non community-wiki answers of a minimum length are eligible