Hot answers tagged rsa
6
I don't believe a lower bound has ever been proven for the "fewest" number of bits needed. Coppersmith showed, however, how given either the $n/4$ least or $n/4$ most significant bits of $p$ where $n$ is the size of the modulus $N=pq$, $N$ can be efficiently factored. Additionally, given the $n/4$ least significant bits of $d$, one can reconstruct $d$ (and ...
5
Well, yes, everyone (or, at least, everyone who can use the public key) knows the hash function H and G; so we can assume that an adversary knows them as well.
You ask:
If YES: How does it help the security, if he just can decode
the padding and read the message?
Well, he can't decode the padding; the ciphertext has been encrypted using RSA, and he ...
3
You could protect the ECIES ciphertext with a superencipherment of DLIES, and you would not be weakening your security unless you slipped up and reused keys or used related keys. That means each step should be done carefully and thoughtfully as if it was the only protection step you would be taking. For example, when generating the cryptographically random ...
3
This result is proven in the following research papers:
Johan Hastad, Mats Naslund. The Security of all RSA and Discrete Log Bits. Journal of the ACM, Oct 2003, pp.1--45.
W. Alexi, B. Chor, O. Goldrech, C. Schnorr. RSA and Rabin functions: Certain parts are as hard as the whole. SIAM Journal on Computing, vol 17 no 2, pp.194--209.
They show that if ...
3
Perhaps you are thinking of the Micali-Schnorr PRNG, as described in Algorithm 5.37 of the Handbook of Applied Cryptography?
Algorithm 5.37 in HAC never states that $e$ is known to the adversary, or even that $n$ is known. Also, Algorithm 5.37 outputs only the least significant bits of the number, on each iteration. So I think you are confusing RSA as ...
3
The main pitfall is possibly thinking that it provides authentication.
The result is still a public key scheme.
It won't help to include the IV in the associated data, since
that is already covered by the authenticated part of AEAD.
Including the RSA-encrypted symmetric key in the associated data would help by making the
resulting hybrid encryption CCA2 ...
3
When we say "RSA is broken" do we mean that a practical attack is discovered to retrieve the private key from the public, or do we mean that given a ciphertext and no knowledge of either the private or the public key the attacker can decrypt the data?
First off, we always assume the attacker has the public key. Someone saying "RSA is broken" could mean ...
3
"Efficient, Compromise Resilient and Append-only Cryptographic
Schemes for Secure Audit Logging" (PDF) gives a publicly verifiable approach that allows
fine-grained verification, but it is in the Random Oracle Model.
The Simple Method:
The verifier and logger start with a seed for a forward-secure pseudo-random number generator.
To denote a valid ending ...
3
In this scenario, you don't need to do any padding (except for the first encryption).
If what you're encrypting with RSA is a random number between 0 and the modulus size, then you don't need any padding. Padding is there to prevent the attacker from using the multiplicative properties of RSA to derive one plaintext from a bunch of others; this attack ...
2
openssl rsautl expects a signature in binary format, not Base64-encoded. You should also check the signature scheme used. PKCS#1 v1.5 and PSS (PKCS#1 v2) are your best bets
The -verify switch is a bit misleading, the command only outputs the decrypted hash. You have to compare with the expected hash yourself.
Beware of the fact that the output will be the ...
2
The AES solution will fail if either:
the secret key is leaked, or
AES-256 is broken.
The RSA+AES solution will fail if either of the above happens, or if:
RSA-4096 is broken.
Thus, even without considering the relative likelihoods of these events occurring within the next 30 years, it is clear that the AES-only solution cannot be any less secure ...
2
First and foremost: it is a bad idea to invent a method to sign or encrypt with RSA (or any crypto). Standards like PKCS#1 or ISO/IEC 9796-2 are here for that purpose, and even these occasionally have more or less subtle flaws.
Given comments, I'll assume that the question is about an RSA encryption scheme enciphering message $M$ into $(M||S)^e\bmod N$, and ...
2
To sign a message $M$ under RSA, one should NOT build the signature as $\mathcal{Sign}(M)=M^d\bmod N$, for several reasons:
either that limits to messages $M$ in range $[0..N-1]$, or that allows forgeries of the form $\hat M=M+k\cdot N$, because $\mathcal{Sign}(\hat M)=\mathcal{Sign}(M)$;
that allows forgeries of the form $\hat M=R^e\cdot\prod{M_j}^{a_j}$ ...
1
If you're trying to describe the Micali-Schnorr PRNG (Algorithm 5.37 in HAC), you have not accurately described the Micali-Schnorr PRNG. The Micali-Schnorr PRNG is cryptographically secure, but yours is not. Where did you get the PRNG you described, and why do you think your PRNG is secure?
The PRNG you described is not secure, if each $x_i$ is output on ...
1
Thinking a bit about your problem, you could potentially strengthen it by chaining key encryption algorithms. Using two-phase encryption (a symmetric algorithm like AES-256 protecting the data, and an asymmetric algorithm like RSA protecting the key) exposes you to weakness in either AES or RSA. You could attempt to strengthen the key protection by adding ...
1
The primary problem with encrypt-then-sign (signing the ciphertext) relates to the difference between signing for the purpose of assigning responsibility vs for the purpose of taking credit. Encrypt-then-sign is OK for the former but not for the latter. The issue is quite subtle.
In particular, in your protocol, the recipient has no reason to believe the ...
1
I'm thinking there's a third potential solution. Each time you close a log file, you could append the name of the next new log file, timestamp it, then sign the log file. When it is time to create a new log file, you would read the previous log file, validate the signature, validate the time stamp, read the new log file name, and create it. You'd ...
1
Edit: You've clarified in the comments that confidentiality of the logfile's contents is important.
Given an AEAD function $C = E_k(iv, plaintext, aad)$, a safe construct is
$$
C = E_k(iv, contents, filename).
$$
There is no need to include either the key or the IV in the additional authenticated data, and I would recommend against doing so. It is ...
1
I take the question as: how to make a chain of RSA encryptions with distinct public keys $(N_j,e_j)$, that is $D_{j+1}=\operatorname{RSA-encrypt}((N_j,e_j),D_j)$, without having the ciphertext size growing at each encryption?
I'll use two facts:
When plaintext $x$ behaves to an adversary about as a uniform non-negative random number less than some bound ...
Only top voted, non community-wiki answers of a minimum length are eligible
