# Tag Info

2

What you have here is indeed a structure called SubjectPublicKeyInfo. It's usually part of an X.509 certificate, but it is often also used separate from a certificate. It's, for instance, the default encoding for RSA public keys in Java and - if I'm not mistaken - OpenSSL. You can view the complete structure here and compare it with the SubjectPublicKeyInfo ...

0

No. $\:$ The adversary lets the public key and the private key and the ciphertext all equal the empty string. $\:$ By doing so, the adversary either created a valid key pair on its own or produced a ciphertext under its public key without the protocol having been followed.

0

Seems like the correct answer to the question, as initially asked by the poster, is forward secrecy. "Nothing" is the wrong answer. Assuming Alice (with public key $PK_A$) and Bob (with public key $PK_B$) know each other's public keys, then they can exchange an ephemeral key $k$. The ephemeral key $k$ can be exchanged in such a fashion that its security ...

0

What you are looking for is so called white-box cryptography. That said, you should definitely check if you can't get away with digital signatures. The reason is that white box cryptography is a special case of program obfuscation that is quite hard to achieve. Existing, practical schemes do not rely on hard problems but rather on not being broken so far. So ...

3

Signing and encrypting together is not secure in this method, at least in the way most would perceive security. For example, Bob would likely interpret this message as being sent from Alice to Bob. However, Alice may have sent it to Charles who decrypted and re-encrypted the signed message under Bob's public-key. In order to do this securely, you need to add ...

0

The case that the (encoded) message may be too long for proper encryption has already been envisioned and mitigated by the designers of the specification of the padding scheme. First note, that $k$ in fact denotes the length of the modulus $n$ - in bytes. This length is always accurate, so if $k=256$ the modulus has a bitlength somewhere in $[2041;2048]$ or ...

2

Instead of trying to invent your own protocol, you'd be much better off using something that is already out there. For example, you could use TLS to transport the data. Another option would be to use GnuPG and some other transport mechanism (post the file on a website to be downloaded by Bob, send it via email, etc). Now, to your question of does this ...

6

What is stopping someone from saving encrypted info, and decoding it later? Nothing. That's exactly why certain three letter institutions build large data centers... Waiting for the first large quantum computer to be built or for new attack techniques that allow to break e.g. RSA for the key sizes used today. Are there any time-sensitive safeguards ...

6

First, let me address the assumption that private keys will be found in a few years using a fast computer. Unless there are serious algorithmic improvements in the cryptanalysis of a scheme, this simply is not true. Of course, the length of the key is of importance, and if you need security for the far future then you should be using 4096-bit keys (or even ...

5

Decoding information within a time frame is of absolute importance. Say X is an terrorist, the information of his attack will be useful today, not years after the attack has happened. And similarly decoding your message is important today, not years later. Also there might be a possibility that when somebody has decoded your key for future use, you might ...

0

@D.W. already gave the explanation. The reason of encryption is faster than decryption is that public key ($e$) for encryption can be chosen manually, while the secret key ($d$) is calculated from the public key and other parameters. Therefore an implementer of the RSA would like to choose small value of public key for fast encryption, since smaller the key ...

3

Essentially any IND-CPA-secure lattice-based cryptosystem offers additive homomorphism, up to a predetermined number of operations. I don't know of any IND-CCA1-secure post-quantum candidate that offers any homomorphic property, except Loftus-May-Smart-Vercauteren SAC'11, which is based on a nonstandard "knowledge of error" lattice assumption.

8

For RSA, the answer whether it is feasible for a single computer depends on the reason your generating them (and specifically, whether they need to remain secure if you publish a number of them). For example, if you're generating the RSA keys to search for some criteria (e.g. the hash of the public key has a specific pattern), and you'll discard the ones ...

10

It is feasible to generate 300 million public key pairs of reasonable strength in 8 hours on a single computer, easily with ECDSA using a single core/thread, and even with DSA using quite a common multi-core computer. RSA would require many standard computers (baring hardware accelerators for modular exponentiation), assuming all the public keys are made ...

1

There should be plenty of them. Off the top of my head, I'm thinking of the provable secure version of NTRU by Stehlé and Steinfeld [1], which is IND-CPA secure. In this scheme, ciphertexts are of the form: $$c = pk \cdot s + p\cdot e + \operatorname{encode}(m)$$ where $s$ and $e$ are random polynomials, $p$ is a small prime, ...

0

Yes, you can perform rudimentary asymmetric encryption or signing by hand, but no it won't be secure. Textbook RSA with small enough numbers is easy to do by hand. Diffie-Hellman to exchange a symmetric key is even easier. However, the kinds of numbers for which this is feasible are far from those needed for real security. There are a lot of other ...

1

TL;DR: use (D)TLS. This is exactly the kind of problem it was meant to solve. If possible, use cert pinning too (if you get to deploy the code on both ends of the channel, this should be possible). The general rule is: don't design your own crypto protocol unless both of the following apply. You have done a detailed review of what exists already and ...

1

Let's assume that the leaked bits were from the "actual" private key, i.e. the primes $p$, $q$, the private exponent or its value modulo one of the primes. A Coding-Theoretic Approach to Recovering Noisy RSA Keys gives a bound of 20% of the key material needing to be known for an attack. Given that you have a 2048-bit key, I don't think leaking 21 bits ...

2

I further assume you mean a DER-encoded unencrypted PKCS#8 RSA key, since you wouldn't care about exposing an encrypted key, and it's a conventional two-prime key with equal-size factors (each 1024 bits) and the ubiquitous e=65537 using the standard PKCS#1 CRT-form representation. I also note that 21 bits is a really odd amount to disclose: not 2 octets, ...

2

Edwards curves can be implemented using a unified formula for addition and doubling; i.e., one can implement addition such that $$\mathrm{dbl}(P)=\mathrm{add}(P,P).$$ Performance wise it is however more efficient to consider both functions separately, since the doubling can be implemented more efficiently than the addition. Depending on the representation ...

4

No, we do not know an algorithm running in linear time (or even polynomial time, relative to the number of digits in $n$) that outputs 'true' if $n$ is the product of exactly two prime numbers, and 'false' otherwise. If such an algorithm existed, I do not see that it would imply possibility to factor $n$, or otherwise break RSA. For sure, it would not be a ...

3

Some background on formal key-exchange models The goal of a key-exchange (KE) is to establish a session key between two parties. Naively, we could say that a KE is secure if no adversary will be able to figure out the session key (in full) established between two honest parties. However, in formal security models we take this a bit further and insist that ...

Top 50 recent answers are included