# Tag Info

7

I don't think idea 1 can be made to work at all. The main point is that in order to generate a correct secret decryption key, the key generator must know the order of $\mathbb Z^*_n$, i.e., the totient of the modulus $n$. The generator knows that $n=p \cdot q$, where it believes that $p$ and $q$ are primes, and so it believes that the totient is ...

5

The attack is even more simple with RSA than with symmetric keys, because the asymmetric encryption key is assumed to be public. Let me tell you a story involving Alice, Bob and Mallory :). Alice wants to send a message to Bob using RSA. Alice encrypts the message using Bob's public key and sends it Mallory performs a Man-In-The-Middle attack, and ...

4

You seem to have some misconception here. Obviously, you are investigating chosen ciphertext attacks (CCAs) on textbook RSA instead of chosen plaintext attacks (CPAs). To help you with your understanding I am discussing CPA on textbook RSA first. To analyse all these kinds of attacks we formally model the attack as a game between an adversary (trying to ...

4

How did they jump from the spectrogram showing the RSA exponentiation timings straight to the secret bits? Actually, they're jumping to secret bits; however those aren't the secret bits you're thinking of. The bits displayed above are not the actual bits of $p$ and $q$. Instead, those are the bits from the secret exponent; because GnuPG uses CRT (and ...

3

Chris's answer is great. As it does not address how one would detect #2, I'll take a stab at it. Assume there is some watchdog looking at public keys in your system, trying to detect a problem. They can easily tell if two public keys share a prime by computing gcd. A gcd of anything other than 1 would identify bad keys. So, let's assume that once two ...

3

The most effective trapdoor I could imagine an adversary building into an RSA key generation algorithm would be the following: Preparation The adversary generates a set of RSA keys of varying sizes. The public keys will be built into the malicious key generation code, the secret keys are kept by the adversary. Key generation algorithm The algorithm is ...

2

You will always need to have some way of identifying the other party, be it a pre-distributed key or out-of-band procedures as you are describing. There is no purely digital method that can do this without some kind of shared knowledge.

2

You are correct; whoever put together the above proof typo'ed that point; we have $c \times d \equiv 1 \pmod {\phi(n)}$, or more accurately, $c \times d \equiv 1 \pmod {lcm(p-1, q-1)}$. On the other hand, the attacker isn't expected to be able to compute step 2 (he can't, he doesn't know the value of $lcm(p-1,q-1)$, and hence cannot compute $d$). Instead, ...

2

Two scenarios: Alice sends a document to Bob that she has signed using her private key. Bob verifies the signature. Alice sends a document to Bob. Bob encrypts a random message for Alice's public key. Alice decrypts it and sends it back to Bob. Bob verifies it's the same. Both will only be possible if Alice has access to the private key, so you might ...

1

You've got the vague idea about it, but you've mixed up some terms (you say Bob uses Amy's private key in your first paragraph when I think you meant to say public key; if Bob has Amy's private key it's all over for her). Also, if it was Bob sending Amy the message, Amy would be trying to verify it was truly Bob who sent her that message, not the other way ...

1

I don't think you will be able to "brute force" decrypt your data. The AES key and IV a probably chosen randomly to encrypt the actual data using some encryption mode. As there is an IV, as you state, it will not be ECB but probably CBC. To get the AES key and IV you need to know the RSA private key D. If the the RSA key pair is chosen carefully, you are ...

1

Simple, $r$ just needs to be co-prime to $n$. To test this check that $gcd(r,n)==1$. This is required since you need to "divide" by $r$, i.e., multiply by $r^{-1}$. $r$ is invertible iff $gcd(n,r)==1$.

1

The other answers tackle 2. very well, so I'll only look at 1. I think it can be made to work in some specific instances, namely if the key generator was part of a closed product with its own key storage or the private key used a format where only the modulus and exponents were stored. (Note that 2. is not common, because knowing the primes can be used ...

Only top voted, non community-wiki answers of a minimum length are eligible