Tag Info

New answers tagged

1

The fastest way to solve your problem instance is as outlined in the above comments. First choose yourself a random message $m$ with $1<m<n$. Now compute $c\equiv m^d \pmod n$. Try if any of the following equations holds, if an equation does hold you've found the public exponent $e$. $m \equiv c^3 \pmod n$ $m \equiv c^{17} \pmod n$ $m \equiv ...


1

The first (and hardest) step is to factor $n$; the easiest way to do this (given $e$ and $d$) is with this randomized procedure: Select a random value $z$ from the range $(2, n-2)$ Compute the value $\lambda = (ed-1)/2^k$, where $k$ is that integer that makes $\lambda$ an odd integer. Compute $t = z^\lambda \bmod n$. If $t = 1$ or $t = n-1$, we fail on ...


1

For a pre-shared secret, you just use a secure MAC to authenticate the key exchange, e.g. for the exchanged public ephemeral keys $A$, $B$ and the resultant shared secret $S$, one side could send $HMAC(PSK, S, A, B)$ and the other $HMAC(PSK, S, B, A)$. Each side can easily verify that the other is using the same exchanged values and shared secret, and that ...


0

There is some software available for the isogeny key exchange. It was developed by one of the designers of the key exchange (DeFeo). It is available on GitHub her: https://github.com/defeo/ss-isogeny-software/ The key exchange was first published in late 2011 and its security has held up under analysis since then. A 2014 paper from Indocrypt supports ...


-3

Well, it is very rarely the case to have a collision. However it is still possible, especially if the Random Number Generator doesn't generate a good random. There is a group of researchers who are working on this problem you can check it out https://factorable.net What they found is that • We found that 5.57% of TLS hosts and 9.60% of SSH hosts share ...


3

There's not really a good way to answer your question other than to explain the concepts involved. The answer can be any one of "yes", "no", or "it depends". Asymmetric encryption algorithms use public keys that have some structure. For instance, RSA public keys are a tuple of $(n,e)$, where $e$ is the exponent, and $n=pq$ for some primes $p$, $q$ unknown ...


0

No there isn't. First, OTP is private-key encryption scheme. Second, Asymmetric key is public-key encryption and No public-key encryption scheme can ever be perfectly secret. This is because the public-key (used for encryption) is available to everyone and is related to the secret-key in some way. Thus, a certain negligible amount of information is leaked. ...


3

If you can efficiently find a $P$ that is not coprime to $N$, then you can easily factor $N$ (use GCD). If you know the factorization of $N$ (say $N=pq$), you can easily find a $P$ that is not coprime to $N$ ($kp$ for some constant $k$). This established the fact that finding $P$ not coprime to $N$ and factoring are equivalent problems. Now, how many ...


4

You are essentially asserting that if $k \equiv 1 \pmod N$, then $a^k \equiv a \pmod N$. This is false in general. The correct assertion is the following: $a^k \equiv a^\ell \pmod N$ if $k\equiv \ell \pmod{\phi(N)}$. In more general group-theoretic terms, if $a$ is an element of order $n$ in a group $G$, then $a^k = a^\ell$ if and only if $k \equiv \ell ...


1

The threshold for a perfectly secure system is that a computationally unbounded adversary cannot conclude anything about the plaintext from the ciphertext. With a public-key system, the attacker can try to encrypt messages with the real public key; this is not possible with one-time pads. What the attacker can do, quite simply, is to try all one-bit ...


5

To generate your pair of keys with elliptic curves first you have to chose your domain parameters (I think this name may comes from the P1363 naming convention, or perhaps it's previous). Those domain parameters will be public. For example for curves over finite fields those parameters are: ${p,a,b,G,n,h}$. The lower level operations will be made in ...


3

You should keep the private key as safe as possible. How safe depends on the security requirements and risk assessment. A key store, such as a PKCS#12 key store or Java key store enables you to store a key protected by - usually - a password. This is obviously more secure than storing it as plaintext at the same location. It is possible to mitigate the risk ...


2

Your calculation is broken. First as pointed out correctly the expected run-time of GNFS (general number field sieve) is: $O(exp((\sqrt[3]{\frac{64}9}+o(1))*\sqrt[3]{ln(n)}*\sqrt[3]{ln(ln(n))}^2))$. So next you can't just set these $O$s equal, as $O(f(x))$ means $O(f(x))< k*f(x)$ which means this is an asymptotic upper bound meaning you need some ...


2

PKCS10 looks like relevant industry practice for private keys. See "Note 2" at page 4, Certification Request Syntax Specification - RFC 2986: The signature on the certification request prevents an entity from requesting a certificate with another party's public key. That is, soneone requesting a certificate on a public key demonstrates his knowledge of ...


2

If you know a multiple of $p$ and $k$ is smaller than $\sqrt(p)$ than you can use a different approach than the one by poncho. Note: knowing a multiple of $p$ is the typical case of RSA where you know the modulus $N$ made by $p\times q$, so if your question refers to RSA you are left only with the constrain on the size of $k$. The method you can use is an ...


4

If $p$ is prime, then $\phi(p) = p-1$; so the question is "given $k(p-1)$, can someone get a good guess of what $p$ might be?" It is unlikely that the attacker would be able to limit it to one particular value of $p$ (as there are likely to be multiple values of $p$ that are plausible), however the attacker might be able to construct a short list of ...


0

Why is diffie-hellman defined on a cyclic group[0]? Doesn't it work for any commutative operation which the inverse is hard to find? No, you need associativity as well; once you have that, your idea would work fine, once we find a semigroup (that's what we call sets with an operator that is associative) with the appropriate properties. That's the ...


2

Diffie-Hellman operates in a cyclic group by definition: the elements $g, g^a, g^b, g^{ab}$ are in the cyclic group generated by $g$. Technically, a monoid is sufficient, but since cryptography mostly operates in finite structures, you get a group anyway. In your example, you operate in the cyclic group $c\mathbf{Z}$, and as you were told in the comments, ...


0

they didn't include P-521, because they wanted a 192-bit security level and P-384 provides that. the reason they didn't use AES-192 probably has something to do with the fact that AES-192 isn't in TLS: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4


6

In the basic fixed window method of performing point multiplication, we compute the value $nP$ (where $n$ is the integer we're multiplying by, and $P$ is the basis point) by finding the base $b$ representation $n = d_k b^k + d_{k-1} b^{k-1} + ... + d_1 b^1 + d_0 b^0$ (where $0 \le d_i < b$), and then computing first $1P, 2P, ..., (b-1)P$ and then $nP = ...


1

A revocation certificate is a self-signature with signature type 0x20. It only says anybody with access to the private key has revoked it, you cannot distinguish between the real owner and an attacker that got hold of the private key. You can read the details of what a revocation certificate contains by executing gpg --list-packets ...


1

Merely receiving a message and seeing that it has a valid signature does not provide any useful information. You also need to know who made the signature, or at least to have some information about them. If you don't know anything about who made the signature, then an adversary can generate their own message using whatever key they like. In your scenario, ...



Top 50 recent answers are included