Tag Info

0

Following the notation in the Low-Exponent RSA with Related Messages and with the simplification $\alpha=\beta=1$, I'll assume $e$, $N$, $c_1=m^e\bmod N$ and $c_2=(m+1)^e\bmod N$ are known, and $m$ is thought. For $e=3$, a little inspiration is enough. We get $c_2+2⋅c_1≡(m+1)^3+2⋅m^3≡3⋅m^3+3⋅m^2+3⋅m+1\pmod N$ thus $c_2+2⋅c_1-1≡3⋅m(m^2+m+1)\pmod N$ ...

2

The scheme you described is not a sensible scheme for 2-way client/server communication. The new RSA public keys are not authenticated, thus you are not safe against active attackers, who could intercept the connection (or replace one of the partners). Those could read all the content, and/or replace it with their own. If you would be using authenticated ...

1

I'm having a hard time parsing your question. If C can compute pre-images on $H$, then he can forge digital signatures from Bob. All C needs is one signature from Bob. Bob signs message $m$, the signature is $S={H(m)}^d\bmod n$. All C needs to do is find an $m'$ where $H(m)=H(m')$. The forged message and signature will be $m'$ and the original $S$.

1

I assume that $m = pq$ (85) is the modulus, and the number you computed (64) is $\phi(m)$. Now we must choose the exponents ($i$ for public, $j$ for secret? , weird notation) in such a way that $ij = 1$ modulo $\phi(m)$. In fact we can work modulo 16 if we like, because that is the least common multiple of $p-1$ and $q-1$. So if we choose $i = 3$, we choose ...

3

Yes, in general the private key is generated at the same time as the public key in RSA, first the $p$, $q$ primes, then $n = pq$, then the public exponent $e$ and finally the private exponent $d$. If the private key is given as $(p, q, d$) then you can recover the public key easily. As long as you know the public exponent and $n$, you have the public key ...

1

Your requirements include the following: S can decrypt the token. C cannot decrypt the token. Since S must be able to do something that C cannot, it needs to know something that C does not. Your approach of signing the token with A's signature is fine for ensuring its integrity (C won't be able to modify it) as long as S knows A's public key through a ...

6

Those appear to be based on the complexity of the General Number Field Sieve, one of the fastest (if not the fastest) classical factoring algorithms. I confirmed this in Mathematica. Here is the complexity for the GNFS (pulled from the linked Wikipedia article): \exp\left( \left(\sqrt[3]{\frac{64}{9}} + o(1)\right)(\ln n)^{\frac{1}{3}}(\ln \ln ...

2

I see three kinds of weaknesses here. The need for padding is not an implementation weakness but an algorithmic weakness. RSA is not an encryption algorithm nor a signature algorithm; RSA-OAEP and RSA-PSS are. It's easy to avoid algorithmic weaknesses: stick to approved algorithms, i.e. OAEP and PSS from PKCS#1 v2. If required for interoperability, you can ...

0

As @Reid mentioned, the HAC is a good starting point. I'd also use Google Scholar to search for papers containing RSA attacks, then follow papers that have many references. Asking about implementation attacks is an overly broad question. There have been a lot of attacks on systems that depend on RSA that have been successful, but most of those weren't ...

4

It depends on what you are using RSA for and how deep of an understanding you would like. A sort of general overview of RSA and potential attacks against textbook RSA is presented in the Handbook of Applied Cryptography, specifically chapter 8. (Note that the entire text is free online.) Chapters 11 and 12 also are useful to read, as they focus on specific ...

1

Don't try to design this kind of protocol yourself; you will get it wrong. Instead, use a well-vetted scheme, like TLS 1.2 with client authentication. This will help you avoid standard mistakes and will provide the security properties you are looking for. For more details, see Don't roll your own crypto..

3

An RSA ciphertext won't reveal who it is encrypted to, but it might reveal some information about who it isn't. We'll assume that everyone has an RSA key of the same length (e.g. 2048 bits). Now, a public key consists of a large modulus N (and an exponent, that's not important for this discussion); a ciphertext consists of a value C between 0 and N-1. ...

2

We do not know the number of possible combinations, since the exact numbers of 1024 bit primes is unknown, but it is MUCH larger than $2048^{16}$. I do not know how you guessed this number, but here are some estimates: For N with 2048 you need primes p,q with 1024 bit each. There are $2^{1023}$ numbers with this length (a leading 1 and then 1023 binary ...

0

The scheme you described is TLS with mutual authentication. The only difference is that TLS generally works with certificates for the public keys (that means public keys which are signed by a trusted party. Also the message exchange beween server and client is done with a symmetric encryption algorithm and only the keys for this are encrypted with RSA.

1

Triple DES and AES are the very same type of scheme: - symmetric block cypher, which also implies fixed size; block sizes are 64 bit for DES, 128 for AES. RSA is asymmetric, and the key length determines the size of plain- and ciphertext. Therefore, with a fixed key length you also have an (almost; length may vary by 1 dependant on choice of primes) fixed ...

-2

Is triple des similiar to rsa in that the message size you can encrypt is limited (unlike AES)? If you mean they both are block ciphers, then yes.

1

I understand that in 2005 SHA-1 was found to have a security flaw and the now recommended standard for this kind of thing is SHA-2 (256 or 512). This post may be of some use: http://stackoverflow.com/questions/3897434/password-security-sha1-sha256-or-sha512

2

You never use RSA to encrypt large binary objects, since it's to expensive to do many calculations. Instead, RSA is used in a key exchange or key transport protocol to send a key for a symmetric-key algorithm, such as AES (with a cipher chaining mode, such as CBC), which is then used to encrypt huge messages. Also note that textbook RSA isn't secure. Some ...

7

In practice, asymmetric algorithms like RSA are usually used for key transport. In other words, instead of a true message, they are used to encrypt a secret key for a symmetric cipher. That symmetric cipher key is used to encrypt the actual message, and that could be gigabytes, depending on the algorithm. Standards like TLS, PGP, and S/MIME use RSA in ...

0

The normal way to encrypt larger data blocks is to use a symmetric crypto algorithm to encrypt the actual data, and then encrypt the symmetric key using RSA.

0

RSA is typcially used for a Symmetric Key Exchange, so most cases dont need more bytes. You can,however repeat the encryption for each block of the message.

4

Göloğlu, Granger, McGuire, and Zumbrägel broke the DLP in the Galois finite field with $2^n$ elements for $n=6120$, and Antoine Joux did it for $n=6168$, with modest computing power. These recent announcements directly imply that cryptosystems (if any) based on the DLP in a field with $2^n$ elements are no longer secure, including for $n$ big enough that ...

5

The advice to avoid $e=3$ comes down primarily to superstition, historical inertia, and general caution, rather than anything with a solid technical basis. Historically, some of the early schemes that used $e=3$ were subject to attack. At the time, many folks drew the conclusion that this means $e=3$ is insecure. However, we now know that that conclusion ...

7

If you compare DSA with SHA-256 and a 2048 bit group modulus $p$, to RSA with SHA-256, a 2048 bit modulus $n$ and public exponent $e = 65537$, on you will at least perform the following operations: DSA $g^{u_1}y^{u_2}$ - 2*256 squares $\mod p$, up to on average 2*128 multiplications $\mod p$, depending on implementation optimizations. RSA $s^e$ - 16 ...

7

The letters d and e are just a notation -- what matters is that there are two exponents, each undoing what the other does, and making one public does not intrinsically reveal the other. By tradition, the one made public is called e. However, there is a twist: the exponent that is not made public, i.e. the private key, can be really private only if it is ...

1

There's nothing special about e -- it's simply a number you select so that e and (p-1)(q-1) are coprime. In general, e will be a small prime, e.g. 7 or 65537 (as per Wikipedia page). d is the multiplication inverse of e modulo (p-1)(q-1). This does not mean that d is simply equal to 1/e -- it is very difficult to obtain d from e unless you also have ...

3

It is well known that you can compute any combinatoric function (and hence, any encryption method) with a sufficient number of NAND gates, and so the answer to your question would appear to be "yes, any algorithm is able to run on a "physical level", without a fancy GUI, multitheaded operating system, memory, processor or even a motherboard". However, I do ...

Top 50 recent answers are included