Tag Info

New answers tagged

4

There is consensus that it is safe to use random primes $p$ and $q$ when generating 2048-bit (or wider) RSA public moduli which two prime factors $p$ and $q$ are about half the key size. That is sanctioned by FIPS 186-4, appendix B.3; specifically, wording in B.3.1 item A: Using methods 1 and 2 [yielding provable (1) and probable (2) random primes], ...


6

There are three distinct computational problems related to RSA. They are: FACTORIZATION: given an RSA modulus $n$, find its prime factors $p$ and $q$; ORDER: given an RSA modulus $n$, find the order $\lambda$ of the multiplicative group modulo $n$; RSA Problem: given a ring element $a \in \mathbb{Z}_n$, a public exponent $e$ and an RSA modulus, find an ...


2

In step 9, you decrypted the ciphertext, 128, to the original message, 2. That's it. You're done with the toy example of naive RSA encryption/decryption. Using RSA in real life, you would apply padding, such as OAEP (also known as PKCS#1v2), to your message before raising it to the e power modulo n. If the plaintext you're trying to encrypt is quite short, ...


0

You can check the freely available book Handbook of Applied Cryptography. Chapter 8.2 has a full description and example.


0

A much better way to choose r is while 1: s = random.getrandbits(KEYSIZE+privacyparameter) r = 1+(s%(n-1)) if gcd(r,n) == 1: break; . privacyparameter is chosen by the blinder. If $\:$ gcd(m,n) = 1 $\:$ then the statistical distance between the distribution of blinded_token and the uniform distribution on units mod n is less $\:$ ...


3

To use the proper terminology: in TLS, cipher suites which include "some Diffie-Hellman" are: Anonymous Diffie-Hellman: DH_anon Static Diffie-Hellman: DH-RSA, DH-DSS... Ephemeral Diffie-Hellman: DHE-RSA, DHE-DSS... There is no "plain DHE" cipher suite in TLS; it is called "DH_anon". As the name indicates, with DH_anon, the server is "anonymous": you ...


2

No, DHE is secure and allows to share a common secret between two parties over an insecure channel. But you cannot know, if the one you share the secret with is the one you want (DHE is vulnerable to man in the middle attacks). So DHE-RSA uses DHE to share a common secret and signs the communication with RSA to make sure, that both persons communicate with ...


0

RSA-OAEP is an encryption scheme that is CCA secure in the random oracle model (http://en.wikipedia.org/wiki/Optimal_asymmetric_encryption_padding). You are talking about encrypting/decrypting hashes with some private/public key, but I don't think you're actually talking about encryption schemes. What you probably mean are digital signature schemes ...


1

In the case of emails your solution is not really practical. The problem is that the sender of an email uses the public key whereas the receiver should have the secret key. This means that whenever somebody wants to send you an email (and therefore generate a new key) you have to be online or you have to provide a set of pre-computed key pairs. If multiple ...


5

How do we keep $\phi(n)$ secret? We don't tell people what it is. The problem of finding $\phi(n)$ given $n$ is a hard problem (if $n$ is hard to factor). So, if we give people a number that they can't factor, and we don't give them $\phi(n)$, they can't determine it on their own.


0

I have a lead about the origin and meaning of $h$, based on the abstract of an ITNG 2008 paper (which is reference [6] of the JACN paper): In this paper, we propose an efficient RSA public key encryption scheme, which is improved version of original RSA scheme. The proposed RSA encryption scheme is based on linear group over the ring of integer mod ...


1

My previous answer was about the IOSR-JECE paper, since you posted the link to JACN paper, I went through that one as well. That paper is considerably better written; it doesn't have any obvious meaningless sentences. Unfortunately, the increased clarity makes it more obvious that their system is insecure as specified. I'll abstract out the bits of the ...


2

Adi Shamir, back in 1995, proposed "RSA for paranoids" in RSA's CryptoBytes newsletter: ftp://ftp.rsasecurity.com/pub/cryptobytes/crypto1n3.pdf. The idea is that you have p of 500 bits, q of 4500 bits, n of 500+4500 = 5000 bits, and constrain m to be 500 bits or less. Then you can encrypt with an exponent of around 20, and decrypt by calculating only m mod p ...


1

s2kcount is an iteration count for the "string to key" (s2k) algorithm used, which would be algorithm for converting a password into an appropriate length key. This iteration count should be "high" -- in many applications it's chosen automatically and so that a significant amount of CPU time is needed for s2k, say between 0.1 to 1 second. What is correct ...


2

Short answer: public exponent $65537$, certainty $5$. Terms and Conditions May Apply. I have no clues about string to key count. Whenever one wants to know " what values are appropriate ", there's the problem of defining appropriate: is there some normative context, e.g. FIPS 186-4? I'll assume that reference. This, and all standards I ...


9

No, there is no specific vulnerability associated to choosing $p$ and $q$ with size differing by $i$ bits (or $2\cdot i$ bits as in the statement) for small $i$. However, if $i$ gets too big: That improves the odds that ECM will manage to factor $n$ for some fixed size of $n$, and at some point ECM will become the best algorithm; this is the case if $i$ is ...


2

If you truly can't be dissuaded from 'using' an RSA key for HMAC, be sure to derive a strong symmetric key using HKDF with a salt and some associated data. I have a suggestion for you based on your comment to Stephen's answer. If all you need to do is store the symmetric key in the key/cert store, why not encode some generated symmetric key in the format ...


2

The reason I am asking about the RSA private key is the HMAC key needs to be stored so that the HMAC can be validated by the server on future requests. An RSA private key is an easy to manage, persistent value. You seem to be under the misguided and mistaken belief that an RSA key is somehow easier to manage and persist than a symmetric key. I am ...


4

The authors of the paper might be able to tell you; I suspect no one else will. You are having problems understanding the paper; a large part of the reason is that the paper isn't very well written; it introduces terminology (such as "ph") without ever defining it, and includes things that don't make any sense, such as the first line of their "Encryption ...


2

Generally, no. There is no calculus in the design and implementation of the RSA. There are two things that could add some analysis in the whole scheme of things: Maybe involving the Prime Number Theorem, which explains why we won't run out of prime numbers to choose from. Some proofs of the theorem use complex analysis (including the simplest known proof, ...


0

The SSL/TLS handshake consists of a series of messages which do keyexchange and (usually) authentication together. See rfc5246 or its predecessors or Wikipedia for details. The handshake actually results in one "premaster secret" and one "master secret" which is then used to derive multiple keys: an encryption key for each direction (for an algorithm that ...


7

Selecting a small $d$ is known to be insecure. Wiener has shown in 1990 that if $\log d \leq \frac14 \log N$, the private exponent $d$ can be reconstructed from the public key $(N,e)$. If you're interested in making the private computational cost cheaper, then I would suggest that RSA is not the best solution; I would recommend you start looking at ...



Top 50 recent answers are included