Tag Info

Hot answers tagged

9

No, there is no specific vulnerability associated to choosing $p$ and $q$ with size differing by $i$ bits (or $2\cdot i$ bits as in the statement) for small $i$. However, if $i$ gets too big: That improves the odds that ECM will manage to factor $n$ for some fixed size of $n$, and at some point ECM will become the best algorithm; this is the case if $i$ is ...


7

Selecting a small $d$ is known to be insecure. Wiener has shown in 1990 that if $\log d \leq \frac14 \log N$, the private exponent $d$ can be reconstructed from the public key $(N,e)$. If you're interested in making the private computational cost cheaper, then I would suggest that RSA is not the best solution; I would recommend you start looking at ...


5

How do we keep $\phi(n)$ secret? We don't tell people what it is. The problem of finding $\phi(n)$ given $n$ is a hard problem (if $n$ is hard to factor). So, if we give people a number that they can't factor, and we don't give them $\phi(n)$, they can't determine it on their own.


4

The short answer is NO. Generally, it is not true that for RSA with no padding, the length of data must be equal to the key length. When and if that applies, that's a restriction of a particular cryptographic library, and either that's not the only restriction about the data, or the library does not allow reliable decryption of what's encrypted. RSA ...


4

The authors of the paper might be able to tell you; I suspect no one else will. You are having problems understanding the paper; a large part of the reason is that the paper isn't very well written; it introduces terminology (such as "ph") without ever defining it, and includes things that don't make any sense, such as the first line of their "Encryption ...


3

There are three distinct computational problems related to RSA. They are: FACTORIZATION: given an RSA modulus $n$, find its prime factors $p$ and $q$; ORDER: given an RSA modulus $n$, find the order $\lambda$ of the multiplicative group modulo $n$; RSA Problem: given a ring element $a \in \mathbb{Z}_n$, a public exponent $e$ and an RSA modulus, find an ...


3

To use the proper terminology: in TLS, cipher suites which include "some Diffie-Hellman" are: Anonymous Diffie-Hellman: DH_anon Static Diffie-Hellman: DH-RSA, DH-DSS... Ephemeral Diffie-Hellman: DHE-RSA, DHE-DSS... There is no "plain DHE" cipher suite in TLS; it is called "DH_anon". As the name indicates, with DH_anon, the server is "anonymous": you ...


2

Though Bob may potentially delay his response by one year or more, the attacker may probably assume that, in practice, Bob will respond rather promptly. Thus, an active attacker can infer from Bob's response, or lack thereof, whether decryption occurred or not. This is a setup where Bleichenbacher's attack seems to apply. However, one must take the fine ...


2

Generally, no. There is no calculus in the design and implementation of the RSA. There are two things that could add some analysis in the whole scheme of things: Maybe involving the Prime Number Theorem, which explains why we won't run out of prime numbers to choose from. Some proofs of the theorem use complex analysis (including the simplest known proof, ...


2

If you truly can't be dissuaded from 'using' an RSA key for HMAC, be sure to derive a strong symmetric key using HKDF with a salt and some associated data. I have a suggestion for you based on your comment to Stephen's answer. If all you need to do is store the symmetric key in the key/cert store, why not encode some generated symmetric key in the format ...


2

The reason I am asking about the RSA private key is the HMAC key needs to be stored so that the HMAC can be validated by the server on future requests. An RSA private key is an easy to manage, persistent value. You seem to be under the misguided and mistaken belief that an RSA key is somehow easier to manage and persist than a symmetric key. I am ...


2

Short answer: public exponent $65537$, certainty $5$. Terms and Conditions May Apply. I have no clues about string to key count. Whenever one wants to know " what values are appropriate ", there's the problem of defining appropriate: is there some normative context, e.g. FIPS 186-4? I'll assume that reference. This, and all standards I ...


2

Adi Shamir, back in 1995, proposed "RSA for paranoids" in RSA's CryptoBytes newsletter: ftp://ftp.rsasecurity.com/pub/cryptobytes/crypto1n3.pdf. The idea is that you have p of 500 bits, q of 4500 bits, n of 500+4500 = 5000 bits, and constrain m to be 500 bits or less. Then you can encrypt with an exponent of around 20, and decrypt by calculating only m mod p ...


2

No, DHE is secure and allows to share a common secret between two parties over an insecure channel. But you cannot know, if the one you share the secret with is the one you want (DHE is vulnerable to man in the middle attacks). So DHE-RSA uses DHE to share a common secret and signs the communication with RSA to make sure, that both persons communicate with ...


1

In step 9, you decrypted the ciphertext, 128, to the original message, 2. That's it. You're done with the toy example of naive RSA encryption/decryption. Using RSA in real life, you would apply padding, such as OAEP (also known as PKCS#1v2), to your message before raising it to the e power modulo n. If the plaintext you're trying to encrypt is quite short, ...


1

s2kcount is an iteration count for the "string to key" (s2k) algorithm used, which would be algorithm for converting a password into an appropriate length key. This iteration count should be "high" -- in many applications it's chosen automatically and so that a significant amount of CPU time is needed for s2k, say between 0.1 to 1 second. What is correct ...


1

My previous answer was about the IOSR-JECE paper, since you posted the link to JACN paper, I went through that one as well. That paper is considerably better written; it doesn't have any obvious meaningless sentences. Unfortunately, the increased clarity makes it more obvious that their system is insecure as specified. I'll abstract out the bits of the ...


1

In the case of emails your solution is not really practical. The problem is that the sender of an email uses the public key whereas the receiver should have the secret key. This means that whenever somebody wants to send you an email (and therefore generate a new key) you have to be online or you have to provide a set of pre-computed key pairs. If multiple ...



Only top voted, non community-wiki answers of a minimum length are eligible