New answers tagged

0

In RSA systems one type of attack is based on the multiplicative property of RSA. Suppose that $y_1=\operatorname{sig_k}(x_1)$ and $y_2=\operatorname{sig_k}(x_2)$ are any two messages previously signed by A. then: $$\operatorname{ver_k}(x_1\cdot x_2 \bmod n,y_1\cdot y_2 \bmod n)=true$$ In this case for avoid this attack, instead of message we can sign ...


0

Just as someone uses a public key, they would also display their hash function. The hash function will make the message smaller, and it also adds security so that keys cannot be forged. Adding a hash function to public key crypto is just an added layer of security.


0

First of all signing does not equal encrypting. It only works on some crypto systems and even then it is not the whole picture. Hash algorithms are used for various reasons. One of them is to reduce the size of the signature since the digest is generally a lot smaller than the message itself. But the main cryptographic reason behind hash functions is to ...


0

The point with hashing is about providing some guarantees like: integrity, unicity of source etc., these are things encryption system used could not provide. But encryption give us some privacy what we can't get just for hashing.


0

In SET, Bob the merchant doesnt need to know message is from Alice the cardholder. Bob needs to get paid for the order received. So Bob proceeds on response from Acquirer (running a SET payment gateway) telling him this particular cardholder (whatever the name) has sufficient funds in his account. This would likely mean funds were reserved, according to ...


2

With such a small block size there is no way to employ RSA padding modes such as PKCS#1 v1.5 padding or OAEP. You could however see the encryption as ECB mode encryption. In that case you could apply padding mechanisms that have been constructed for symmetric block ciphers. Those padding modes however have been defined for bytes rather than characters. ...


1

This is an issue with any block cipher. One solution is to pad the message. This means that, first you split it into blocks and then you will have some remaining characters at the end that are not one whole block. So lets say that the block length is L and you have n characters. You can add at the end of your message L-n extra characters so that with those, ...


4

You can do something like what you are suggesting. But, the EC_Dual_DBRG also has biases in the stream and so you cannot use it without changes (e.g., truncating much more). However, this is based on the same operations as ElGamal. The public key is set up exactly as proposed. Then, to encrypt a message $m$ of any length, do: Choose a random ...


1

This is - in a way - Functional Encryption. From Wikipedia: Functional encryption is a type of public-key encryption in which possessing a secret key allows one to learn a function of what the ciphertext is encrypting. So, YES, it is possible. For more information this paper might prove useful.


2

what is the range for exponent e? Actually, there is no required upper bound for $e$ (except that some implementations may reject ridiculously large values). The math behind RSA states that any $e$ that is relatively prime to both $p-1$ and $q-1$ will work, no matter how large it is. There might not appear to be a need for an $e > lcm(p-1, q-1)$ (as ...


0

As explained on this page you have: $1 < e < \phi(n)$ so with the specific values you mentioned we have: $\phi(n) = \phi(p \times q) = \phi(p) \times \phi(q) = (p-1) \times (q-1) = 12 \times 16 = 192$ (see Euler's totient function definition) The threshold on the maximum integer you can encrypt is $n-1$ which is $76$ if $p=7$ and $q=11$. Note that if ...


4

What you are looking for is a definition of PEM, privacy enhanced mail. Obviously PEM is not just used for mail anymore. The definition of the header lines seems to be best described by section 4.6: "Summary of Encapsulated Header Fields" of RFC 1421: "Privacy Enhancement for Internet Electronic Mail: Part I: Message Encryption and Authentication ...


3

I'm answering this based on the TLS v1.2 certificate based client authentication feature. Other protocols may vary in the details. Can anybody tell me what is being sent from the user's side for getting authentication from the server? The overhead to a normal handshake consists only of the user's certificate (+ intermediate certificates eventually, ...


3

That doesn't hide Bob's identity from eavesdroppers. (The OP mentioned in chat that the OP isn't trying to do that.) I can no longer spot any other problems with the key exchange part. The encryption/decryption of application level data is vulnerable to arbitrary replays and reflection and dropping. ​ The public MAC input should indicate direction and ...


1

Perhaps a simplified example or two might help you intuitively understand the concept. Let's say you want to let your little brother and sister encrypt messages so that either of them can encrypt any message, but only you can decrypt them. To keep things simple, let's say that the messages are simply numbers from $1$ to $10$. Your siblings have been ...


2

Theorem: Let $gcd(a,n)=1$ and $\phi(n)$ be Euler's totient function, then $a^{\phi(n)} \pmod n=1$. One of this famous methods for encrypting is RSA. In this method we use above theorem. Let $e,n$ are public and $\phi(n) , d$ are private such that $e\cdot d =1\pmod {\phi(n)}$$(e\cdot d=1-t\cdot \phi(n))$. For encryption we have: ...


0

There is a paper by Daniel Bleichenbacher and Alexander May called "New attacks on RSA with small secret CRT-Exponents" (you can find it under http://www.cits.rub.de/imperia/md/content/may/paper/crt.pdf). They are not quite able to break the RSA under your assumptions. I'm not aware of better results, but I didn't look at the list of articles citing this ...


0

In his paper, Wiener suggests using large values of $e$ when the exponent $d$ is small. When $e>N^{1.5}$, Wiener's attack will fail even when $d$ is small. Boneh and Durfee attack is an improvement for Wiener's attack. With this attack you can decrypt $c$. This attack use $LLL$ algorithm. For more detail you can see "Cryptanalysis of RSA with Private ...


0

Have a look at order revealing encryption (ORE) schemes: https://eprint.iacr.org/2014/834.pdf


1

You'll have to write the function you are trying to calculate as a polynomial in the two inputs $x$ and $y$. If you are working over the field with $q$ elements as plaintexts, you have to calculate for equality the polynomial $(x-y)^{q-1}$. Greater-than-or-equal (however you define that for finite fields) will be even more complicated.


0

Typically a few methods of establishing a shared secret (temporary or permanent) requires at least two active parties to be online at the same time to do the key agreement live. What Maarten proposes is to simply store a draft message secured somewhere only User A can access until User B gets to finalize a shared secret with User A then is the secured ...


2

RSA modules factoring are not hard in general case. In special cases we can factor numbers easily. One of these special cases is weak prime number, if at least one of two RSA modules primes is weak we can factor it easily. It is interesting that number of such $1024$ bit modules are at least $2^{750}$ and for $2048$ bit is $2^{1500}$. Your mentioned RSA ...


4

The field of cryptography that you are looking for is called Kleptography. In kleptography, we are dealing with a setting where the device performing your cryptographic tasks is potentially malicious. Now this device tries to leak information to some attacker that allows this attacker to break the used cryptographic scheme. If I am not mistaken that scheme ...


10

Actually, if the RSA key generation is malicious, there are even more subtle ways that can someone can leak the key. The cleverest way I've seen works like this (assuming that we're generating an RSA-1024 key; for RSA-2048, we just use a larger curve): The attacker generates an EC public/private key pair; using a 192 bit curve for RSA-1024 is good. He ...


4

Does the length of the public key imply the length of the private key, or can they be unrelated? Yes. The sizes of public and private keys depend on the cryptosystem. Usually they are related somehow, but not necessarily. For example, you can store a short value as a private key, which is then used as a PRNG seed to generate the private key used in the ...


2

Is javascript RSA signing safe? …is safe or can people forge… In contrast to the accepted answer, I would not call it “safe” from a cryptographic point of view and I would definitely not say that “ if you take good care of securing your environment where you run the JS code you will be OK. ” because the sad fact is: that’s not enough to ensure ...


2

I will assume for simplicity that you're talking about the full multiplicative group of $F_p$ instead of a proper subgroup, thus there are no problems with $g^a+1$ (except when $g^a=p-1$ which can be trivially ruled out by comparing to $p$). The quantity $\log_g(g^a+1)$ is sometimes referred to as the Zech logarithm (strictly speaking, it is defined for ...


2

What you seem to be looking for is a scheme like the following: It consists of two algorithms, a key generation algorithm $K$ and a "key use" algorithm $U$. The key generation algorithm outputs a pair of keys $(k_0, k_1)$. The "key use" algorithm takes as input a key and an element from some set $S$ (which may depend on $k_0$ and $k_1$), and outputs an ...


1

There is 3 kind of discrete log problem as you explained : Diffie-Hellman problem (Dlog): Pick $a \in \{1,\ldots,q\}$. Compute $A = g^a (mod\ p)$ Given $(p,q,g,A)$ find $a$. Assumed hard. Computational Diffie-Hellman problem (CDH) : Pick $a,b \in \{1,\ldots,q\}$. Compute $A = g^a (mod\ p)$ and $B = g^b (mod\ p)$ Given $(p,q,g,A,B)$ find $g^{ab}$. Note ...


3

This is a rather open ended question, but I'll try to answer: Limitations: most ECDSA implementations require a secure random generator - if the same random value is reused (for different plaintext) then the private key parameter can simply be calculated; ECDSA requires a hash function and cannot be (easily?) used for signatures with message recovery ...


0

$gcd(r,(p-1)/r)$ needs to be $1$ in Benaloh cryptosystem that mean that $(r)$ and $(p-1)$ are preliminary among them.


1

Preliminary on notation: in the question, it seems advisable to change $C=T_{k}M$  to $C=T_{k}(M)$ , and change $M=T^{-1}_{k}C$  to $M={T_k}^{-1}(C)$ it is necessary to change $T_{k}T^{-1}_{k}=I$  to ${T_k}^{-1}\circ T_k=I$ , meaning that the function obtained by applying $T_k$ then its inverse ${T_k}^{-1}$ is identity, with $\forall M, ...


1

I think it covers both symmetric and asymmetric systems. Given a transformation $T_k$, if computing $T^{-1}_k$ is easy then this is a symmetric cryptosystem. On the other hand, if this is difficult than it is an asymmetric one. Note that in this case, we are ''hard-coding'' the key $k$ inside the transformation. Thus we are just given the transformation ...


1

Your definition only covers symmetric encryption since the same "index" $k$ is used in $T_k$ and $T^{-1}_k$ (i.e., encryption and decryption use the same key) If you want to give a generic definition that covers both types of encryption, you could say that the transformations are $T_k$ and $T^{-1}_{k'}$ and that in the case of symmetric encryption $k'=k$.


2

Yes, this seems to make sense and it is a plausible solution. The KEM approach does not work, unless you use some tricks, like including a hash of the message in the KEM. (That could work, of course.) Security goal The type of scheme we are looking at consists of three algorithms $(K,E,D)$. The key generation algorithm $K$ outputs two keys, say $k_0$ and ...


3

RSA with random exponents would fulfill your key-swapping requirement. I.e. RSA where you generate one exponent randomly and then compute the other from it normally, with neither exponent made public. The operation to encrypt and decrypt is the same (modular exponentiation). The security of this scheme, or some uses of it is considered in the (currently ...


1

Simply put, there are two key-pairs for DHE_RSA instead one key-pair of RSA_RSA. For example, for AES128_CBC_SHA(long name is RSA_RSA_AES128_CBC_SHA), you have one key-pair for both key-exchange and authentication. for ECDHE_RSA_AES_CBC_SHA, you have two key-pairs. The ECC key-pair is temporary for key-exchange. The RSA key-pair from cert is used for ...



Top 50 recent answers are included