# Tag Info

3

Yes, it is possible to deterministically generate public/private RSA key pairs from passphrases. For even passable security, the passphrase must be processed by a key-stretching function, such as Scrypt (or the better known but less recommendable PBKDF2), and salt (at least, user id) must enter the key-stretching function; the output can then be used as the ...

3

There is no cryptographic advantage in picking any particular alignment for RSA key sizes, whether it's powers of 2, multiples of 64, multiples of 2, ... The difficulty of cryptographic attacks pretty much grows with the number of bits. As already noted by fgrieu, there is a slight advantage to the defender in working with sizes that are a multiple of 32 or ...

2

Why does this prevent the attack? Why doesn't the attacker just infer that the connection failed because of the bad padding? Why else could the connection fail? Well, the connection may fail because the host decrypted a valid pre-master secret, and it wasn't the pre-master secret that we expect. That is, when the attacker injects his encrypted message, ...

2

Bleichenbacher's attack relies on being able to determine whether the padding was correct or not. The patch tries to ensure that the following two (previously distinguishable) cases look identical to an attacker: the padding was correct, but the attacker has no knowledge of the transmitted pre-master secret — hence he can't use the resulting symmetric keys ...

2

The security proof of RSASSA-PSS assumes that the private key is used only for RSASSA-PSS purposes, that hypothesis is violated, thus the security proof does not hold (but as long as RSASSA-PKCS1v1_5 remains usable, you do not have a security proof anyway). Similarly, the wide consensus that RSASSA-PKCS1v1_5 is secure in practice was formulated without ...

2

Q: How long shall the RSA key be in order to be secure against practical attacks? A: Impractically large. This does not imply that RSA is unsafe against practical attacks; only that some of these attacks must be prevented by ways other than increasing the key size. That's because key size is not a parameter with a major impact on the efficiency of many ...

1

OBVIOUS, if you write $f(x)=(1+2^8+2^{16}+2^{24})\times x=K\times x$. Then $f(x)\times f(y)=K^2\times x \times y$. Then $\forall y$, choosing $z \in (\mathbb{Z}/n.\mathbb{Z})^{*}$ allows to dermine the unique $w \in \mathbb{Z}/n.\mathbb{Z}$ satisfying this relation in the multiplicative group.

1

Using the Chinese Remainder Theorem I can compute $M^3$, and then take the cube root. This is why multiple recipient RSA is insecure.

1

FIPS 140-2 specifies conditions applicable to the environment of RSA (and other) key generation, and refers to FIPS 186-4 for the generation itself. Several recent Java Card Smart Cards can internally generate RSA-2048 key pairs per FIPS 186-4, with security policy and FIPS 140-2 level 3 certificate to attest that. Here is the one on top of the list at time ...

Only top voted, non community-wiki answers of a minimum length are eligible