# Tag Info

2

You can't get a man-in-the-middle (MitM) resistant channel out of a vacuum. You need some common knowledge beforehand. Luckily all one needs is a shared trust relation. Suppose the server Steve trusts Carol, suppose further the client Charlie trusts Carol aswell. As an example I'll give a simplified TLS-RSA key exchange because it's particularly easy. ...

1

Your idea seems secure, but it is more complicated than it needs to be. If you only need to know if the "secure information" in the document matches some public information (stored on an insecure computer), it is enough to calculate a preimage resistant hash of the document (e.g. SHA-256). The document needs only to be unguessable, like a 256-bit random ...

17

Actually, if you're willing to consider a somewhat larger $e$, I found a solution that makes the decryption part real cheap. This solution has $e = 446185741$ and $n = ... 7 An option strictly matching the question's statement (wich requires$e=65537$) is to choose the public modulus$n$as the product of many small primes$p_i$, perhaps$k=64$primes of$32$bits. That's multiprime RSA pushed to the max. The potential speedup is considerable. For small$k$, the speedup compared to normal RSA with CRT is in the order of$k^2/4$; ... 0 The case that the (encoded) message may be too long for proper encryption has already been envisioned and mitigated by the designers of the specification of the padding scheme. First note, that$k$in fact denotes the length of the modulus$n$- in bytes. This length is always accurate, so if$k=256$the modulus has a bitlength somewhere in$[2041;2048]$or ... 2 Let's try to simplify and abstract your protocol a bit. Instead of your server and client, we just have two parties, let's call them Sally and Charlie. Charlie has a key pair$K = (K_i, K_u)$for a suitable asymmetric cryptosystem$\mathcal E$. We assume that this cryptosystem is partially homomorphic, such that$\mathcal E_K(a) \otimes \mathcal E_K(b) = ...

0

If you don't mind using ruby you can do something like this: require 'openssl' key = OpenSSL::PKey::RSA.new key.e = key.d = key.n = key.p = key.q = puts key.to_pem If you don't set p and q then you'll get the public key format, if you do you'll get the private key format

0

@D.W. already gave the explanation. The reason of encryption is faster than decryption is that public key ($e$) for encryption can be chosen manually, while the secret key ($d$) is calculated from the public key and other parameters. Therefore an implementer of the RSA would like to choose small value of public key for fast encryption, since smaller the key ...

2

Both the AES key size and the RSA key size matter, because it's no use adding security beyond the weakest link. Here the weakest link is 2048-bit RSA, which is considered roughly equivalent in security to 100-128-bit symmetric keys (depending on who you ask). So having a password with much more than 100 bits of entropy would be fairly useless. In practice, ...

5

The prime number theorem says that there are approximately $N/\log{N}$ primes less than $N$. If we consider $2048$ bit RSA, that means the primes we are using are $1024$ bits. How many $1024$ bit prime numbers are there? Approximately $2^{1025}/\log{2^{1025}} = 2^{1025}/1025\approx 2^{1015}$ (from the theorem). So, just to store the primes we are going to ...

1

I'm quickly assuming your question asks how to retrieve the public (RSA-) key from a set of samples of unencrypted and encrypted messages. If you're question is about: "How can I get my files back after being infected by CryptoWall?" I suggest you read the hits by the search function on InfoSec. Please also note that in most use cases RSA isn't used to ...

2

Some information about the RSA public key is revealed by the ciphertext. This is due to the fact that the ciphertext is a value between 1 and the modulus. Beyond this, I don't know what is revealed. However, what I can prove is that whatever you can learn from the plaintext and ciphertext together, you can learn from the ciphertext only. I can prove this ...

4

No, if the RSA cryptosystem is secure, i.e. when it uses random padding such as PKCS#1 v1.5 padding or OAEP, then you cannot. As Stephen already mused, it is pretty likely that you can find out the key simply because it is included or can be derived; generally public keys are not meant to be secure. If textbook (raw modular exponentiation) RSA is used then ...

2

The ciphertext should look like a random element within 1 and the modulus (since it is a value from within that range as Yehuda Lindell pointed out). Without knowing the modulus it should not be feasible to distinguish two ciphertexts encrypted with different keys. If the public key is stored in some key-database you could ofc try to encrypt the decrypted ...

2

Yes, and it's devastatingly effective, too. See OAEP and other RSA/asymmetric-function padding standards. OAEP is what you should use these days so far as I am aware. PKCS#1 has other defined padding schemes also (eg PSS, PKCS1.5), only some of which are effective.

-2

You can use the RSA key encapsulation to establish a random symmetric key. Then (in the same protocol message) use this key to protect the data payload (i.e. using some AE/AEAD mode you mentioned). The RSA key encapsulation should be Padding Oracle Attack resistant (as it does not use any padding). Another advantage is that your payload length is not ...

5

With pure asymmetric encryption there is no way to ensure integrity and authenticity, since anyone who knows your public key can encrypt any message for you. For that you would need either a symmetric key to use for a MAC (in which case you could use it/derivatives for symmetric encryption too) or a signature from the sender. And in the latter case the ...

0

There exist polynomial time attacks against RSA signatures with constant padding. So, this actually does not exploit the missing check for the padding. It uses index calculus The latest paper that I am aware of in this series is http://www.dtc.umn.edu/~odlyzko/doc/index.calculation.rsa.pdf but you might also be interested in this paper: ...

1

Let's assume that the leaked bits were from the "actual" private key, i.e. the primes $p$, $q$, the private exponent or its value modulo one of the primes. A Coding-Theoretic Approach to Recovering Noisy RSA Keys gives a bound of 20% of the key material needing to be known for an attack. Given that you have a 2048-bit key, I don't think leaking 21 bits ...

2

I further assume you mean a DER-encoded unencrypted PKCS#8 RSA key, since you wouldn't care about exposing an encrypted key, and it's a conventional two-prime key with equal-size factors (each 1024 bits) and the ubiquitous e=65537 using the standard PKCS#1 CRT-form representation. I also note that 21 bits is a really odd amount to disclose: not 2 octets, ...

6

The statement a 15360-bit RSA key is the equivalent to a 256-bit symmetric key does not take into account quantum algorithms. In fact, it is based on a specific computation model. It is just based on the fact that there exist sub-exponential algorithms for factoring and therefore you need longer keys than when using symmetric-key crypto where it is ...

1

They are both the same size, however they were created at different times during the factoring challenge, which is why one uses the bit size and the other uses the decimal size. They are created from different primes and are not directly related to eachother other than the fact they are both from the chllenge. The first series of numbers in the challenge ...

3

If you are using a secure signature algorithm, padding and all, then it must be secure for messages of any length. So in that sense you are good. However, in many protocols your messages must include something to prevent replay attacks, like an incrementing counter, in which case you shouldn't be signing just a single number if the messages are meant to say ...

1

The multiplicative group $Z_m$ of integers modulo $m$ has exactly $\phi(m)$ elements by definition. Thus for any element $a$ of $Z_m$ the equation $$a^{\phi(m)}=1~(mod~m)$$ holds, where $1$ is the multiplicative identity of $Z_m$ (the residue class $km+1$ of all integers congruent to 1 modulo $m$). In RSA, $e$ and $d$ are indeed inverses modulo ...

0

The equation above starts as $e\cdot d\cdot d^{-1} \equiv d^{-1}\cdot 1\bmod{(p-1)\cdot (q-1)}$ I replaced the $=$ in the original equation with $\equiv$ which is a congruence relation. This is undoubtedly what the author of the image meant. It is important to note that the congruence relation applies to the entire equation, not just the right hand side. ...

4

No, we do not know an algorithm running in linear time (or even polynomial time, relative to the number of digits in $n$) that outputs 'true' if $n$ is the product of exactly two prime numbers, and 'false' otherwise. If such an algorithm existed, I do not see that it would imply possibility to factor $n$, or otherwise break RSA. For sure, it would not be a ...

2

If you were using $e=3$, then there is a well known attack by Bleichenbacher that enables the trivial generation of a signature that passes verification. This attack was never published, but is described here. Note that this attack appeared in a real vulnerability in Kindle (and some versions of Android). In any case, the attack does not work for $e=65536$. ...

1

if(checkValue.compareTo(resultOfModulus) == 0) Here's your problem; you're checking if $y^3 = (md5BigInteger \bmod 2^i)$; that's wrong (as $md5BigInteger \bmod 2^i$ won't typically be a cube). Instead, what you want is to check if $y^3 \equiv md5BigInteger \pmod{2^i}$; or, in other words (thinking less like a mathematician, and more like a programmer) if ...

1

Ok, RSA is a asymmetric crypto system. Which means you have a separate key for encryption and decryption. Remember RSA is based on cyclic groups. So don't forget the modulo. Here are the basic equations. $n$ is the product of $p$ and $q$. $\varphi(n) = (p-1)*(q-1)$ $gcd (e, \varphi(n)) = 1$ - for calculating the e. e is random but must fit this equation. ...

1

Steps 5 and 7 remain very important even when one ignores DoS attacks. $\;\;\;$ The RSA key-pairs use ​ e = 3 $\;\;\;$ Server signs $\: \langle \hspace{-0.03 in}$ RSA_modulus , RSA_ciphertext $\rangle \:$ and returns that to Client in step 3 $\;\;\;$ If computation is significantly more of a bottleneck than communication, $\;\;\;$ then Client computes ...

Top 50 recent answers are included