# Tag Info

7

As long as you use a secure padding mode (i.e. -pkcs or -oaep, not -raw). The default padding mode for openssl rsautl is -pkcs (i.e. PKCS#1 v1.5), so you should be OK. That said, OAEP is recommended over PKCS#1 v1.5 padding, so you might want to use the -oaep switch.

5

No, it not possible to attack RSA (and practical modulus size) with a WalkSat derivative, as far as we know, or using the algorithm in the question. Problem with that algorithm is: in order to have a sizable/constant rate of success as $n$ increases, we have to repeat steps 2 and 3 not the stated $t\cdot m^2$ times, but rather $t\cdot 2^m$ times. That's ...

5

Yes, RSA is secure as we know it — although recommended key sizes are ever-increasing, as expected. Any seemingly-simple result that suggests a long-studied, well battle-hardened cryptosystem is insecure should throw up red flags. As an exercise, I wrote up your algorithm in simple C code: #include <stdio.h> #include <stdlib.h> int ...

3

In RSA encryption as practiced (that is, to encipher a message which is a short symmetric key), the message size after padding is fixed and equal to the modulus size. Thus the size of the message has no impact on performance. Calculating a modular inverse is performed only during key generation, that is seldom. Also, it has low cost compared to generating ...

3

The issue is that we use modular arithmetic. In modular arithmetic, you may view $m \bmod n$ as the remainder of $m$ when divided by $n$. So, for example, $7 \bmod 2 = 1$, also written as $7 \equiv 1 \pmod 2$, because $2(3) + 1 = 7$. Now consider what you're guaranteed by $m \equiv c^d \pmod n$, the decryption formula for plain RSA. You're guaranteed that ...

2

As long as you ensure that $n_1\leq n_2$ is guaranteed, the value $r^em\pmod {n_1}$ can be treated as an element in $Z_{n_2}$ and the "outer blinding" and "outer unlinding" in $Z_{n_2}$ does not change this value. Consequently, if you compute the "inner unblinding" in $Z_{n_1}$ after the "outer unblinding" your proposal works. Remarks from the previous ...

2

ECB, CBC and such cipher modes are something that relate to symmetric cryptography. In context of RSA, it is important to study from documentation of the product what they mean as they do not ordinarily apply. Based on the articles you provide, this statement is correct: The mode, ECB in this case, is ignored for RSA.Use PKCSPadding. The max amount of ...

2

I can several possible questions in the original post, hopefully I'll manage to answer at least one of them here. I have calculated a large $N$, with $\log_{10}(N)>600,000$. Is this suitable for RSA? We have that $\log_{10}(N)>6*10^5>2^{19}$, meaning $\log_2(N)>2^{19}$. Currently, implementations with $\log_2(N)\approx 2^{11}$ are coming into ...

2

The current best way of decryption an RSA ciphertext (assuming good padding was used) is to factor $N$ into its prime factors $p$ and $q$, and from that, reconstruct the decryption exponent $d = e^{-1} \bmod lcm( p-1, q-1 )$ The current record for factoring an RSA-type modulus (with large prime factors, and not of a special form) is 768 bits. It is likely ...

2

We don't say this can't happen, we just say it won't happen. The only value that will decrypt to $p_2$ under $(e_2,n_2)$ is $p_2^{d_2}$, which we can call $s_2$. So, your problem comes down to asking what is the probability that $s_1=s_2$? If we assume that they're random, and that the moduli are similar enough sizes that this is even a realistic ...

2

The performance bottleneck with RSA is the modular exponentiation operation. On the other hand, if you are interested in public key encryption performance, perhaps RSA is not the correct tool. RSA is actually fairly fast during its encryption operation; however it is quite slow during the decryption. If you care about decryption performance, you may want ...

2

Short Answer: NO, it is not safe, do NOT do this. Longer Answer: You are true that you can use your RSA keypair for both operations. This approach is used in many applications and scenarios. There are Web Services or Single Sign-On implementations, which enforce you to use the same key pair for both operations. X.509 certificates do not allow you (by ...

2

The first byte is 0x00, because some standards allow RSA key sizes $8b+1, b \in \Bbb Z_+$. Such key would have 0x01 at the first bit, but it is possible for almost all other bits to be zero. Thus, 0x00 as the first byte allows interoperability with all possible RSA key sizes. NIST's recommendations and few other standards actually recommend only few ...

1

No, exposing such a hash does not compromise the RSA private key, unless the hash function is sufficiently and severely broken. Of course, you don't need to hash the private exponent to identify the key. You can simply use the modulus or a hash over the (public) modulus to identify the key. This has the additional advantage that that ID will also match the ...

1

A signature scheme with message recovery is standardized as ISO/IEC 9796-2 (link to preview). Scheme 1 in this standard is commonly used in the Smart Card industry, despite its known weaknesses in a chosen-message setup. Example real-life uses include the EMV banking application (the free documents linked there include a description of an industry-standard ...

1

If it only multiplies mersenne primes then likely not. For now I can think of RSA, DSA and the Diffie–Hellman key exchange for its uses (They use prime numbers). There are not enough mersenne primes for it to be used by itself. May be in can be used as part of a process. (Specialization).

Only top voted, non community-wiki answers of a minimum length are eligible