# Tag Info

4

The original poster clarified that: the application of RSA is signature (not encryption as originally stated); at least one signature $s$, the value of $N$, and $e=3$ are given; the signature is by signing an MD5 hash of a message, and a hash of the message matching the signature $s$ is also a given. The first, low-effort thing to do with the givens is ...

4

Your description of the protocol is rather confused. You seem to jump between a key and an encryption output. It isn't clear whether you're worried about the key generation process, or an encryption operation that happens with this key. I assume that you're talking about RSA with a 128-byte key, not 128-bit — 128 bits was already insecure when RSA was ...

4

PKCS#1 padding succeeds in introducing enough entropy (slightly less than 64 bits at the very minimum) to make RSA encryption semantically secure. Furthermore, the number $m$ - the message used for modular exponentiation - it produces will be large enough to protect against attacks that rely on $m$ to be small. That means that the premisses for RSA modular ...

3

Suppose you have two message-signature pairs, $(m_1, s_1), (m_2, s_2)$, where $s_i = m_i^d \bmod n$. Suppose we also know the public exponent $e$—it is usually $65537$, $3$, $5$, $17$, or some similar small integer. Then we know that $m_i = s_i^e \bmod n$, or in other words $s_i^e = k_in + m_i$ and it follows that $\gcd(s_1^e - m_1, s_2^e - m_2) = \gcd(k_1, ... 3 There are three main errors here: Exponent$e$must be chosen to be coprime with$\phi$. In your question, exponent$e = 3$is not coprime with$\phi = 1008$. You can choose$e = 5$instead. You must use integer arithmetic, not floating-point. In other words, you cannot have values expressed with decimals. You cannot encrypt a message bigger than the ... 2 On encrypting the same plain text, I get two different outputs. This is in fact a design goal of encryption systems: an adversary who sees two ciphertexts should not be able to tell whether they're equal — that would be an information leak. Even encryption systems that would otherwise be secure use an initialization vector or other similar unique value ... 2 Am I correct in assuming the above? No you are not. You are showing textbook/raw RSA, which is little more than modular exponentiation. To be secure RSA has to use padding methods. Without padding, RSA would indeed generate the same ciphertext each time. This alone would break the security requirements of a cipher. There are many other attacks on ... 2 Yes, in your specific case,$d=1031$is the answer. You can check it in the following ways: Just try it out. Select some arbitrary messages, exponentiate with$e$, apply the modulus and exponentiate them with$d$. If this yields your original message number (like 20 or 5001) you know it's the correct$d$. Factor$N$using the exponent. You may want to use ... 2 I unfortunately don't have enough reputation to comment, forgive the answer that is a link to another answer. Your question is explained well in this answer: http://crypto.stackexchange.com/a/12706/17884 2 As far as the standard (PKCS#1) is concerned, the primes need not have the same length; the smallest should not be "too small" to avoid getting in range of the ECM factorization method, but there is still a lot of margin here. However, some implementations can be more limited. For instance, Windows' implementation of RSA (in CryptoAPI) assumes that, for a ... 2 "RSA/ECB/PKCS1Padding" - as you already found out - is not really implementing ECB. For instance Bouncy Castle also has "RSA/None/PKCS1Padding" to mean the same thing. ECB is used for block cipher modes of operation, and RSA is not a block cipher. For block ciphers ECB makes some kind of sense; it basically means performing the block cipher operation for ... 2 So let's first recall how blinded RSA works: Select primes$p=11$and$q=29$, calculate the modulus$n=pq=209$, choose a public exponent$e=7$. Now calculate the signature exponent$d\equiv e^{-1} \pmod{(p-1)(q-1)}$($d=103, (p-1)(q-1)=180$). Now let's go to the message-dependant processing: A message$M$is represented as the integer$m$which is blinded ... 1 In RSA,$\phi(N)$is hidden and this is why nobody could calculate private key. For a prime modulus, order of multiplicative group is not a secret. Well, this question looks like encouraging your own thinking of RSA and related arithmetic, so please keep digging in. 1 It's not the algorithm that's more "efficient" (that's just a welcome side-effect) but the security level. Security levels are usually given in bits; to say that a cipher has 80 bits of security means that we assume it takes roughly$2^{80}\$ effort to break it, for some definitions of "effort" and "break". For RSA, the main problem is factoring large ...

1

If you can recover the private key from a message and a signature (and the public key), then that signature method is broken, and broken quite bad. We believe that RSA, with a decent signature padding method, is secure, and hence the specific failure mode you mentioned cannot happen. There are two obvious ways to try to recover the private key for RSA; we ...

1

At first I want to cite Lindell and Katz book: A "plain Rabin" encryption scheme, constructed in a manner analogous to plain RSA encryption, is vulnerable to a chosen-ciphertext attack that enables an adversary to learn the entire private key. Although plain RSA is not CCA-secure either, known chosen-ciphertext attacks on plain RSA are less damaging ...

Only top voted, non community-wiki answers of a minimum length are eligible