Tag Info

Hot answers tagged

6

Definitions In RSA, an encryption key is a pair of integers $(N,e)$ with $N$ the product of $m\ge2$ distinct odds secret primes $r_i$ (with $0<i\le m$), and $e$ is such that $\gcd(e,\lambda(N))=1$ where $\lambda(N)=\operatorname{lcm}(r_1-1,\dots,r_m-1)$ is the Charmichael function. It follows that $e$ is odd. Typically, other conditions are added, like ...


5

Here are some hints on how it's done on Mega: The password provided is passed through a KDF to derive a key, that is used to en-/decrypt the master key (later provided by the server through an API call). To bring it down to the crucial bits: The KDF applies $2^{16}$ rounds of AES-128 with it. The details can be found in the function prepare_key() of the ...


3

If an appropriate padding mechanism is used then you cannot directly encrypt the private key with the public key as the input size would be too large. If hybrid encryption is used (RSA + AES) then the answer is no. You could possibly raise (modulo $n$) the private exponent to the power of the public exponent. So then you would need to retrieve $d$ from $d ^ ...


3

A keyspace is the set of all possible keys; it's a set. The cardinality of the keyspace is an integer, and is the number of elements in the keyspace. There is no possibility of confusion, because one is a set and the other is an integer.


3

Using this property, you can't fully break RSA (meaning you can't get the private key). However there are a few attacks. If you're using RSA for public-key encryption, there's an adaptive chosen ciphertext attack. Suppose you want to decrypt $c$ and A is decrypting everything but $c$ for you. Now you can chose your $c_1=x^e*c$ with $x\in Z_n^*$. Now you ...


3

If we signed a secret message $m$ by publishing its signature $σ$ computed as $m^d\bmod N$, at least two very bad things would happen: The message would not be so secret anymore That's because anyone knows the public key $(N,e)$, and thus from $σ$ can compute $σ^e\bmod N$, which is $m\bmod N$. This reveals a lot of information about $m$, which goes ...


3

The site also misrepresents RSA encryption. If you are using textbook RSA (i.e. this scheme, with no padding), you don't independently encrypt each letter. Rather, you take the entire message, treat it as a number, and encrypt that. This doesn't work if your primes are 3 and 11, but if they're each, say, 8 bytes long, then you could encrypt a 16-byte ...


3

You are correct that in this case simple frequency analysis would be possible since textbook RSA encryption is deterministic. One can get around this by using RSA with random padding. Here are a few references: Why is padding used for RSA encryption given that it is not a block cipher? OAEP Why RSA encryption padding is critical In practice, we ...


2

openssl rsa -pubin -inform PEM -text -noout < public_key.pem Public-Key: (64 bit) Modulus: 16513720463601767803 (0xe52c8544a915157b) Exponent: 65537 (0x10001) The modulus is small enough that you can easily factor it After finding the prime factors, you can calculate the private exponent After you have the private exponent, you raise each 64-bit block ...


2

Well, consider if Bob is communicating with Alice; Bob sends Alice a random $r^e$, Alice recovers $r$ and sends it back. Then, they proceed to use the same RSA modulus to negotiate a secret key; for example, Bob picks a secret value $m$, computes $m^e$, sends that to Alice, who recovers $m$, and then they both use $m$ to generate secret keys, and use those ...


1

Because RSA takes advantage of the fact that: $a^{\phi(n)} \equiv 1 \mod n$ Which means: $a^{\phi(n)+1} \equiv a \mod n$ So, in order to encrypt and decrypt using $e$ and $d$, we need: $ed \equiv 1 \mod \phi(n)$ Which can only be true if $gcd(e,\phi(n)) = gcd(d,\phi(n)) = 1$


1

To summarize the factorization method briefly: Substitute $p$ and $q$ with $(a+x)$ and $(a-x)$, where $a = (p+q)/2$. That gives you the formula $N = (a+x)(a-x) = a^2-x^2$. If $x$ is much smaller than $a$, then $N$ is very close to $a^2$, so $\sqrt N = a - \epsilon$ (for some small $\epsilon$) So all you need to do is find the square root of $N$, round it ...


1

First, RSA "encrypt with private key" and "decrypt with public key" are semantically wrong; these don't provide confidentiality which is the purpose of encryption, but they can provide integrity which is the purpose of signature. The fact that RSA sign/verify operations are mathematically similar to encrypt/decrypt led to this misuse of terminology back in ...


1

No, it wouldn't. Very simply put: If you can compute square roots wrt. a composite modulus, then you can calculate other fixed roots, too. This is based on the fact, that being able to compute square roots allows you to factor the modulus: Choose random $x$. Compute $x^2$. apply your square root algorithm to $x^2$. The result $y$ will be a different ...



Only top voted, non community-wiki answers of a minimum length are eligible