Tag Info

Hot answers tagged

7

Copy / paste that key into http://phpseclib.sourceforge.net/x509/asn1parse.php and you'll see that there are several different integers in there. p is there, q is there as is the exponent and several other integers to speed things up by taking advantage of the Chinese Remainder Theorem. The key is encoded using DER and derives semantic meaning via ASN.1. ...


5

It is correct that the given private key does not encode a single integer, and that it includes two primes $p$ and $q$. More precisely, that Base64 data encodes a string of bytes, which is an RSAPrivateKey encoded per ASN.1 DER-TLV (and thus BER-TLV) following PKCS#1v2 Appendix A.1.2 (likely restricted to version 0). It decodes to: 30 ASN.1 tag for ...


4

Well, if the hash function is weak, then the attacker might be able to take a valid signature for a signed message, and find a second message for which the signature for this first would also validate for the second. For example, if Alice signs the message "I like chocolate", what Bob might do is find a second message "Alice owes Bob $13,106,107.57", and ...


4

While the way that Robert showed can work if $e$ is small (and if $e \cdot d \equiv 1 \pmod{\phi(n)}$ (which is not necessarily true), there is a slightly more complicated method which will work in any case. What we do is compute $\lambda = (e \cdot d - 1)/ 2^k$ odd (and $k$ is the integer that makes $\lambda$ odd. The special property that $\lambda$ has ...


3

To start with, it's certainly not a bad idea to avoid SHA-1 when other algorithms exist, which do not have the SHA-1 weaknesses to anyone's knowledge. The security of SHA-1 depends on how you're using it. The vulnerability is what's known as a collision vulnerability: an attacker has the ability to create two input strings with the same SHA-1 hash with less ...


2

Generally the public exponent is small. then if you know the public and private key, then you can compute $e.d=1+k.\phi(n)$. k is smaller than e and $\phi(n)$ is in the range of n. A direct method allow to make an exhaustive search on the small k which divide ed-1 in such a way that $\frac{e.d-1}{k}$ is an integer. Then $\phi(n)= p.q -(p+q)+1$ allow to find ...


2

OAEP is likely to be secure as long as the underlying primitives - RSA using modular exponentiation and the hash function to generate the padding - are considered secure. So the OAEP padding in itself should not pose any problems. That said, we don't know if your protocol is secure, nor if the RSA / OAEP implementation is secure. It could for instance be ...


2

To find multiplicative inverse (d) mod φ(n) you may use Extended Eculdian Algoritm "EEA"(or any other algorithm but EEA is usually used to best of my knowledge). The algorithm is explained here http://en.wikipedia.org/wiki/Extended_Euclidean_algorithm this online tool computes the inverse using EEA http://www.cs.princeton.edu/~dsri/modular-inversion.html ...


2

With regards to the public vs private keys, in RSA, the public key is used to encrypt information, the private key is used to decrypt it. Given only the public key, all you can do is encrypt. So, you can publish that online somewhere (key distribution is a very different problem). Anyone can use it to encrypt a message to you and only you can decrypt it. ...


2

The modulus $N$ is implicit in the group $\mathbb Z_N^\ast$ that $c$ and $g$ are chosen from. That is, in this context, $g^a$ is taken to mean "the residue class represented by $x^a\bmod N$ where $x$ denotes some representant of $g$'s residue class". Therefore, when additionally requiring that $a\geq3$ and odd, this notion is equivalent to the strong RSA ...


2

Timestamps, as mentioned by user93353, are one possible answer. The drawback is that they require synchronized clocks, which can't always be assumed. Another possible approach to prove liveness (that is, that this isn't a replay) is for the receiver to select a random value (a "nonce"), send that to the server, and have the server sign the command ...


1

Without waiting to get a collision, there is a more annoying scenario : compute the gcd of all public keys you can scan over the net. Experience did show that a lot of systems do not generate enough unique entropy ( Lenstra, A., et al., "Ron was wrong, Whit is right", Cryptology ePrint Archive Report 2012/064, February 2012, http://eprint.iacr.org/2012/064 ...


1

Both PKCS#1 v2.1 and RFC 3447 define OAEP in quite a different way. In the graphic used on Wikipedia a lot of things are missing (for instance the label and the exact sizes of the fields). To answer your question: The cryptographic functions G and H both are typically the function mgf1 (mask generating function) with SHA1 as defined by RFC 3447. Pseudocode ...


1

While OAEP uses a one-way function on the plaintext, it's not quite a hash: it's called a mask generation function (MGF), and unlike a hash it can produce as much or as little output as you want (the output length is an argument to the function, and input length is decoupled from output length). This output should be pseudorandom. You use this in a ...


1

There exist many standards which describe a lot of padding modes and security protocols. If you're new in that field, I strongly recommend you to study the family of PKCS standards which are the reference in the domain. There also exist other distinct standards depending of very specific application fields (Banking, mobile, Cloud, Embedding ... or Global ...


1

(Realised my mistake as I finished typing the question) Finding the multiplicative inverse is in fact computationally feasible. The prime numbers p and q are not public (although n = pq is). An attacker cannot therefore know φ(n), which is required to derive d from e. The strength of the algorithm rests on the difficulty of factoring n (i.e. of finding p ...


1

all those concerns have been studied a lot and still are. I'll try to give some keywords for them. a web app that stores all data on the server in a way that the server can't decrypt the data even if it wanted to. Solution for this is User-side encryption. That's why, forget about the server chosing the encryption key himself. It's quite well spread ...


1

What about the beautiful images on this page, Certificate Binary Posters part 1 and part 2? I'd believe they would be useful in this case.


1

You can use the Web tool pgpdump, available at this address http://www.pgpdump.net/ or the same tool ( http://www.mew.org/~kazu/proj/pgpdump/en/) to install on your pc. This latter is to use if you are poking with your real secret key. At the moment I don't remember if the tool outputs in hex or dec, but you can easily convert to your favourite Base ...


1

To conclude the answers here's a note about the simplest way (on linux at least) to view the contents of such keys with openssl: $ openssl rsa -in test.key -text Private-Key: (512 bit) modulus: 00:83:8b:7a:98:1d:a9:7a:cc:d3:b3:b8:75:5f:e7: 27:98:12:03:5d:a3:72:30:5e:05:72:b9:99:93:bb: 19:ce:fb:f0:7b:af:84:98:be:46:fa:a1:4a:2f:36: ...



Only top voted, non community-wiki answers of a minimum length are eligible