Hot answers tagged

12

Actually, if the RSA key generation is malicious, there are even more subtle ways that can someone can leak the key. The cleverest way I've seen works like this (assuming that we're generating an RSA-1024 key; for RSA-2048, we just use a larger curve): The attacker generates an EC public/private key pair; using a 192 bit curve for RSA-1024 is good. He ...


9

Hash functions must be public, so if you want use RSA as hash function you should fix $K$. Now let $n$ be the RSA module and $H$ denote RSA hash function. We have $$H(M)=H(M+n)$$ so this function is not second preimage and collision resistant. Also this system is not first preimage resistant (with known public and private key): Let $M^k=h \pmod n$ ...


6

If performing as in a typical description of textbook RSA, Bob has: secretly drawn distinct primes $p=83$ and $q=103$; computed $n=p\cdot q=8549$; computed $\varphi(n)=(p-1)\cdot(q-1)=8364$ where $\varphi(n)$ is Euler's totient function; chosen $e=445$, as some arbitrary $e>1$ with $\gcd(e,\varphi(n))=1$; published his public key $(n,e)\;$, which in ...


5

The field of cryptography that you are looking for is called Kleptography. In kleptography, we are dealing with a setting where the device performing your cryptographic tasks is potentially malicious. Now this device tries to leak information to some attacker that allows this attacker to break the used cryptographic scheme. If I am not mistaken that scheme ...


5

One way to approach this problem is to first look at the simpler problem of that cardinality of $x^e \bmod p$ where $p$ is prime, and $gcd(p-1, e)$ might not be 1. In that case, we have two cases: $x \equiv 0 \pmod{p}$, which makes it obvious that 0 will always be a possible postimage, and $x \in \mathbb{Z}^*/p$; in this second case, that group is ...


3

That doesn't hide Bob's identity from eavesdroppers. (The OP mentioned in chat that the OP isn't trying to do that.) I can no longer spot any other problems with the key exchange part. The encryption/decryption of application level data is vulnerable to arbitrary replays and reflection and dropping. ​ The public MAC input should indicate direction and ...


3

With an alphabet of 27 characters, the maximum number of characters that can fit into one plaintext block is equal to the largest integer less than or equal to $\text{log}(n) / \text{log}(27)$: $$\bigg\lfloor\frac{\text{log}(59768553302699443)}{\text{log(27)}}\bigg\rfloor = 11$$ On the other hand, assuming the ciphertext is represented as a string of ...


2

Which cryptographic algorithm would they want to use? That will really depend on the situation. To select the algorithms one should ask himself (at least) the following questions: Which standards do you trust? Which standard do you have to use? What computations can you afford? Symmetric, or public key based? It again depends on the situation. ...


2

Is javascript RSA signing safe? …is safe or can people forge… In contrast to the accepted answer, I would not call it “safe” from a cryptographic point of view and I would definitely not say that “ if you take good care of securing your environment where you run the JS code you will be OK. ” because the sad fact is: that’s not enough to ensure ...


2

What you seem to be looking for is a scheme like the following: It consists of two algorithms, a key generation algorithm $K$ and a "key use" algorithm $U$. The key generation algorithm outputs a pair of keys $(k_0, k_1)$. The "key use" algorithm takes as input a key and an element from some set $S$ (which may depend on $k_0$ and $k_1$), and outputs an ...


2

1a lHash: What is this and where does this come from? That's in PKCS#1 v2.1: RSAES-OAEP-ENCRYPT ((n, e), M, L): 2a. If the label L is not provided, let L be the empty string. Let lHash = Hash(L), an octet string of length hLen (see the note below). 1b) PS: A string of zeros, but how much zeros? Similarly for this question, lets ...


2

Theorem: Let $gcd(a,n)=1$ and $\phi(n)$ be Euler's totient function, then $a^{\phi(n)} \pmod n=1$. One of this famous methods for encrypting is RSA. In this method we use above theorem. Let $e,n$ are public and $\phi(n) , d$ are private such that $e\cdot d =1\pmod {\phi(n)}$$(e\cdot d=1-t\cdot \phi(n))$. For encryption we have: ...


2

With such a small block size there is no way to employ RSA padding modes such as PKCS#1 v1.5 padding or OAEP. You could however see the encryption as ECB mode encryption. In that case you could apply padding mechanisms that have been constructed for symmetric block ciphers. Those padding modes however have been defined for bytes rather than characters. ...


2

In real word RSA modules are so large that probability for finding $c_1$ which is not coprime with $n$ is approximately zero. Also if you founded such number then $p=gcd(c_1,n)\neq1$ so $p$ is a factor of $n$ and in this case attack is not necessary because $n$ is factored. $gcd(296,1073)=37\neq 1$ so $p=37,q=\frac{1073}{37}=29$ and $\phi(n)=1008$ Now ...


2

You need an authentic channel from Alice to Bob to get a secret channel from Bob to Alice. This assumption is missing in a), so anyone in control of the communication channel can play man in the middle on any protocol. As long you don't have a secret channel from Alice to Bob or an authentic channel from Bob to Alice, Alice will never (= for any protocol) ...


2

what is the range for exponent e? Actually, there is no required upper bound for $e$ (except that some implementations may reject ridiculously large values). The math behind RSA states that any $e$ that is relatively prime to both $p-1$ and $q-1$ will work, no matter how large it is. There might not appear to be a need for an $e > lcm(p-1, q-1)$ (as ...


2

RSA modules factoring are not hard in general case. In special cases we can factor numbers easily. One of these special cases is weak prime number, if at least one of two RSA modules primes is weak we can factor it easily. It is interesting that number of such $1024$ bit modules are at least $2^{750}$ and for $2048$ bit is $2^{1500}$. Your mentioned RSA ...


1

Well this depends on your key size. But, in general: A 1024-bit RSA key using OAEP padding can encrypt up to (1024/8) – 42 = 128 – 42 = 86 bytes. A 2048-bit key can encrypt up to (2048/8) – 42 = 256 – 42 = 214 bytes. And so on. It is highly recommended you use at least a 2048-bit key. If you need to encrypt more data just break it down into blocks of ...


1

Typically, what we do when we encrypt a large piece of text with RSA is: We select a random symmetric key (perhaps, an AES key) We encrypt that symmetric key with RSA We then use that symmetric key to encrypt the actual message. So, as far as the RSA algorithm is concerned, it doesn't matter how long the message is. This is called a hybrid cryptosystem. ...


1

The problem is to reliably and efficiently find message $m$ (with $0\le m<n$) given RSA modulus $n$, distinct RSA public exponents $e_1$ and $e_2$ coprime to each others and to the unknown $\phi(n)$, and ciphertexts $c_1=m^{e_1}\bmod n$ and $c_2=m^{e_2}\bmod n$. WLoG, and per the corrected question, $y_1$ is negative when it is applied the extended ...


1

Preliminary on notation: in the question, it seems advisable to change $C=T_{k}M$  to $C=T_{k}(M)$ , and change $M=T^{-1}_{k}C$  to $M={T_k}^{-1}(C)$ it is necessary to change $T_{k}T^{-1}_{k}=I$  to ${T_k}^{-1}\circ T_k=I$ , meaning that the function obtained by applying $T_k$ then its inverse ${T_k}^{-1}$ is identity, with $\forall M, ...


1

I think it covers both symmetric and asymmetric systems. Given a transformation $T_k$, if computing $T^{-1}_k$ is easy then this is a symmetric cryptosystem. On the other hand, if this is difficult than it is an asymmetric one. Note that in this case, we are ''hard-coding'' the key $k$ inside the transformation. Thus we are just given the transformation ...


1

Perhaps a simplified example or two might help you intuitively understand the concept. Let's say you want to let your little brother and sister encrypt messages so that either of them can encrypt any message, but only you can decrypt them. To keep things simple, let's say that the messages are simply numbers from $1$ to $10$. Your siblings have been ...



Only top voted, non community-wiki answers of a minimum length are eligible