# Tag Info

16

This is a common mistake, so I'd like to give an in-depth answer. Basically, what you are proposing is to rely on the ONE-WAYNESS of RSA as a ONE-WAY FUNCTION, rather than relying on its CPA or CCA security as an encryption scheme. The advantage of using RSA as a one-way function is that no padding etc is needed. Now, the first important thing to note is ...

5

Choosing $\lambda(n)$ rather than $\varphi(n)$ may result in a smaller private exponent.

5

The main reason why the prime factors $p$ and $q$ of RSA modulus $N$ must be distinct is stated in the question: if they are equal, given $N$ (which by definition is public in RSA), it is trivial to find $p=q=\sqrt N$. A secondary reason is that with $p=q$, a few messages $x\in\{0\dots N-1\}$ can't be reliably deciphered from $x^e\bmod N$: all those $x$ ...

4

Doesn't this reduce the search space for the primes P and Q by half? I can't see how it does. After all the attacker can see $N$, and so can determine what bits are set. Allowing, say, a 2047 bit composite (rather than a 2048 bit) doesn't make his job any harder; he can see whether the composite in front of him is either 2047 or 2048 bits long. What ...

4

Your description of the protocol is rather confused. You seem to jump between a key and an encryption output. It isn't clear whether you're worried about the key generation process, or an encryption operation that happens with this key. I assume that you're talking about RSA with a 128-byte key, not 128-bit — 128 bits was already insecure when RSA was ...

3

It should be proven in any presentation of RSA that, with a correct public modulus $N$, public exponent $e$ and private exponent $d$, all integers $m \in \{0,1,\dots,N-1\}$ satisfy $$\left(m^e\bmod N\right)^d\bmod N = m.$$ So it is only possible for a number to "not encrypt or decrypt correctly" when it is not in $\{0,1,\dots,N-1\}$. Moreover, this necessary ...

3

It is an important feature to be able to see if encryption/decryption failed. Sure, padding oracles are a problem, but so is a protocol that doesn't perform intrinsic verification of the performed operation. If you have a key agreement protocol then you need some kind of method of validating that the decryption of the symmetric key succeeded. Now you could ...

2

If Eve can find an $n'$ that is prime (and $n'-1$ is relatively prime to $e$),then she can easily sign any message with that $n', e$ pair. So, the question is: what is the probability that there exists a prime $n'$ such that there is only one bit difference between $n$ and $n'$, and $n' \not\equiv 1 \pmod {e}$ ? The answer is that it is quite good if $e ... 2 The tests you can do depend on how much time you want to spend for checking each certificate and the "stupidity" you assume for the given key-owner. You already mentioned the basic checks: Modulus is too small, only interesting if it's smaller than 1024 bits Exponent is unusual, not exactly a vulnerability in most cases The following attacks may take ... 1$\big(\hspace{-0.03 in}$You don't need that.$\:\operatorname{L}\hspace{-0.02 in}\operatorname{cm}\hspace{.02 in}(\hspace{.04 in}p\hspace{-0.04 in}-\hspace{-0.05 in}1,\hspace{-0.02 in}q\hspace{-0.04 in}-\hspace{-0.05 in}1)$can be used instead of$\phi(N)$.$\hspace{-0.03 in}\big)k$is an integer which will make the quotient an integer. ... 1 One property that this unpadded system is that it is homomorphic; if$A^d = X$and$B^d = Y$, then we know that$(AB)^d = XY$, and it doesn't matter if we don't know what$d$is. More generally, if we have a collection of$H_1, H_2, H_3, ... H_n$, and a collection of signatures$S_1, S_2, S_3, ..., S_n$, then for any set of integers$e_1, e_2, e_3, ..., ...

1

In RSA, $\phi(N)$ is hidden and this is why nobody could calculate private key. For a prime modulus, order of multiplicative group is not a secret. Well, this question looks like encouraging your own thinking of RSA and related arithmetic, so please keep digging in.

1

Making sure this oracle you're talking about is not available to an attacker is a bit harder than just saying so. When we first heard of the Vaudenay attack on CBC (https://www.iacr.org/archive/eurocrypt2002/23320530/cbc02_e02d.pdf) we thought that we had done enough to "get rid of the oracle" and we found out with the Lucky13 attack ...

Only top voted, non community-wiki answers of a minimum length are eligible