Tag Info

New answers tagged

1

OBVIOUS, if you write $f(x)=(1+2^8+2^{16}+2^{24})\times x=K\times x$. Then $f(x)\times f(y)=K^2\times x \times y$. Then $\forall y$, choosing $z \in (\mathbb{Z}/n.\mathbb{Z})^{*}$ allows to dermine the unique $w \in \mathbb{Z}/n.\mathbb{Z}$ satisfying this relation in the multiplicative group.


2

Q: How long shall the RSA key be in order to be secure against practical attacks? A: Impractically large. This does not imply that RSA is unsafe against practical attacks; only that some of these attacks must be prevented by ways other than increasing the key size. That's because key size is not a parameter with a major impact on the efficiency of many ...


3

Yes, it is possible to deterministically generate public/private RSA key pairs from passphrases. For even passable security, the passphrase must be processed by a key-stretching function, such as Scrypt (or the better known but less recommendable PBKDF2), and salt (at least, user id) must enter the key-stretching function; the output can then be used as the ...


0

It is just customary, and enforced by products like GPG and OpenSSL which include code to block you choosing your own exact bitlength (they enforce padding or rounding, for no particular reason). Here is the GPG code that enforces this, for example: if( nbits < 768) { nbits = 2048; log_info(_("Keysize invalid; using %u bits\n"), nbits ); ...


3

There is no cryptographic advantage in picking any particular alignment for RSA key sizes, whether it's powers of 2, multiples of 64, multiples of 2, ... The difficulty of cryptographic attacks pretty much grows with the number of bits. As already noted by fgrieu, there is a slight advantage to the defender in working with sizes that are a multiple of 32 or ...


0

For a definitive answer, you really should see the documentation for the data format you're dealing with, but just quickly looking at the XML response, it would seem that you're dealing with a hybrid encryption scheme. That is, your encrypted message consists of two parts: The actual data (in xenc:EncryptedData), encrypted using AES-CBC with a single-use ...


1

Using the Chinese Remainder Theorem I can compute $M^3$, and then take the cube root. This is why multiple recipient RSA is insecure.


1

FIPS 140-2 specifies conditions applicable to the environment of RSA (and other) key generation, and refers to FIPS 186-4 for the generation itself. Several recent Java Card Smart Cards can internally generate RSA-2048 key pairs per FIPS 186-4, with security policy and FIPS 140-2 level 3 certificate to attest that. Here is the one on top of the list at time ...


2

Why does this prevent the attack? Why doesn't the attacker just infer that the connection failed because of the bad padding? Why else could the connection fail? Well, the connection may fail because the host decrypted a valid pre-master secret, and it wasn't the pre-master secret that we expect. That is, when the attacker injects his encrypted message, ...


2

Bleichenbacher's attack relies on being able to determine whether the padding was correct or not. The patch tries to ensure that the following two (previously distinguishable) cases look identical to an attacker: the padding was correct, but the attacker has no knowledge of the transmitted pre-master secret — hence he can't use the resulting symmetric keys ...


2

The security proof of RSASSA-PSS assumes that the private key is used only for RSASSA-PSS purposes, that hypothesis is violated, thus the security proof does not hold (but as long as RSASSA-PKCS1v1_5 remains usable, you do not have a security proof anyway). Similarly, the wide consensus that RSASSA-PKCS1v1_5 is secure in practice was formulated without ...


0

It's interesting to mention another type of faulty attack on RSA public modulus. Up to now the majority of research papers are about how to break the system after a fault attack in regular or CRT mode. An interesting approach (among all the surveys of fault attacks on RSA), is describerd in this paper ...


0

For anyones who's interested - From this paper http://scholar.lib.vt.edu/theses/public/etd-32298-93111/materials/etd.pdf I found that it's best to find the degree of the polynomial you're going to be using based on the number of bits in $N$. Let k = $log_2N$ Briggs gives experimental bounds $d= 5$ for $k \geq 110$ $d= 4$ for $80 > k > 110$ $d= 3$ ...


0

Your Question is related to the well know RABIN Cryptosystem which is similary like RSA, except the public exponenent is 2. As fgrieu mentionned it, decipherment can be easilly processed by the CRT algorithm, but some precautions must beforehand be observed during the key generation. In fact the resolution the equation gives 4 roots, which mean that the ...


0

In this case, take a look to the GQ identication scheme, from Guillou and Quisquater.



Top 50 recent answers are included