Tag Info

New answers tagged

1

This scheme follows the KEM/DEM approach of contructing secure asymmetric encryption schemes. However for a KEM/DEM PKCS (public key cryptosystem) to be secure it is required that both the key encapsulation mechanism (KEM) and the data encapsulation mechanism (DEM) are CPA or CCA secure for CPA or CCA of the whole scheme. Indeed the DEM looks CPA secure as ...


1

$\big(\hspace{-0.03 in}$You don't need that. $\:$ $\operatorname{L}\hspace{-0.02 in}\operatorname{cm}\hspace{.02 in}(\hspace{.04 in}p\hspace{-0.04 in}-\hspace{-0.05 in}1,\hspace{-0.02 in}q\hspace{-0.04 in}-\hspace{-0.05 in}1)$ can be used instead of $\phi(N)$.$\hspace{-0.03 in}\big)$ $k$ is an integer which will make the quotient an integer. ...


3

It is an important feature to be able to see if encryption/decryption failed. Sure, padding oracles are a problem, but so is a protocol that doesn't perform intrinsic verification of the performed operation. If you have a key agreement protocol then you need some kind of method of validating that the decryption of the symmetric key succeeded. Now you could ...


0

You can easily factor $N$ in sagemath. You will take $N=71237436024091007473549 \cdot 71237436024091007474233.$ So $\phi(N)=5074772291286459206773897733187023839031615136.$ Now check that $e^{-1}\mod \phi(N)=1031$ which is equal to the value you found.


2

If Eve can find an $n'$ that is prime (and $n'-1$ is relatively prime to $e$),then she can easily sign any message with that $n', e$ pair. So, the question is: what is the probability that there exists a prime $n'$ such that there is only one bit difference between $n$ and $n'$, and $n' \not\equiv 1 \pmod {e}$ ? The answer is that it is quite good if $e ...


2

The tests you can do depend on how much time you want to spend for checking each certificate and the "stupidity" you assume for the given key-owner. You already mentioned the basic checks: Modulus is too small, only interesting if it's smaller than 1024 bits Exponent is unusual, not exactly a vulnerability in most cases The following attacks may take ...


1

One property that this unpadded system is that it is homomorphic; if $A^d = X$ and $B^d = Y$, then we know that $(AB)^d = XY$, and it doesn't matter if we don't know what $d$ is. More generally, if we have a collection of $H_1, H_2, H_3, ... H_n$, and a collection of signatures $S_1, S_2, S_3, ..., S_n$, then for any set of integers $e_1, e_2, e_3, ..., ...


5

The main reason why the prime factors $p$ and $q$ of RSA modulus $N$ must be distinct is stated in the question: if they are equal, given $N$ (which by definition is public in RSA), it is trivial to find $p=q=\sqrt N$. A secondary reason is that with $p=q$, a few messages $x\in\{0\dots N-1\}$ can't be reliably deciphered from $x^e\bmod N$: all those $x$ ...


0

You can use the next_prime function available in the GMP library, after generating a random large number. Here's the link : https://gmplib.org/manual/Number-Theoretic-Functions.html


0

They are used to encrypt symmetric keys. ​ No.


4

Doesn't this reduce the search space for the primes P and Q by half? I can't see how it does. After all the attacker can see $N$, and so can determine what bits are set. Allowing, say, a 2047 bit composite (rather than a 2048 bit) doesn't make his job any harder; he can see whether the composite in front of him is either 2047 or 2048 bits long. What ...


16

This is a common mistake, so I'd like to give an in-depth answer. Basically, what you are proposing is to rely on the ONE-WAYNESS of RSA as a ONE-WAY FUNCTION, rather than relying on its CPA or CCA security as an encryption scheme. The advantage of using RSA as a one-way function is that no padding etc is needed. Now, the first important thing to note is ...


5

Choosing $\lambda(n)$ rather than $\varphi(n)$ may result in a smaller private exponent.


3

It should be proven in any presentation of RSA that, with a correct public modulus $N$, public exponent $e$ and private exponent $d$, all integers $m \in \{0,1,\dots,N-1\}$ satisfy $$\left(m^e\bmod N\right)^d\bmod N = m.$$ So it is only possible for a number to "not encrypt or decrypt correctly" when it is not in $\{0,1,\dots,N-1\}$. Moreover, this necessary ...


1

Making sure this oracle you're talking about is not available to an attacker is a bit harder than just saying so. When we first heard of the Vaudenay attack on CBC (https://www.iacr.org/archive/eurocrypt2002/23320530/cbc02_e02d.pdf) we thought that we had done enough to "get rid of the oracle" and we found out with the Lucky13 attack ...


0

The problem with DRM is that the keys must be revealed to the end user machine and thus susceptible to interception. Not to mention I believe that the Sony PlayStation uses ECDSA to secure its firmware and it got cracked.


4

Your description of the protocol is rather confused. You seem to jump between a key and an encryption output. It isn't clear whether you're worried about the key generation process, or an encryption operation that happens with this key. I assume that you're talking about RSA with a 128-byte key, not 128-bit — 128 bits was already insecure when RSA was ...


1

In RSA, $\phi(N)$ is hidden and this is why nobody could calculate private key. For a prime modulus, order of multiplicative group is not a secret. Well, this question looks like encouraging your own thinking of RSA and related arithmetic, so please keep digging in.



Top 50 recent answers are included