Timeline for RSA-KEM construction

Current License: CC BY-SA 3.0

7 events
when toggle format what by license comment
Oct 7 '21 at 7:59 history edited CommunityBot
replaced https://tools.ietf.org/html/rfc with https://www.rfc-editor.org/rfc/rfc
May 21 '18 at 9:29 comment added David 天宇 Wong @thejh it should be the same, the probability of having 0, 1, or a small m is indeed too small. Looking at RFC 5990 they actually include 0 as part of the range :) tools.ietf.org/html/rfc5990#appendix-A
Apr 10 '15 at 7:43 comment added Ruggero I think it's different. For a generic $m$ you have to brute-force, here you just look at the ciphertext and you know m, no computation required. However I agree that if you trust your random generator then it's not even worth to check since odds of getting it $\leq 1$ is negligible.
Apr 9 '15 at 18:25 comment added thejh The same argument works for any $m$. The attacker can simply calculate $x^e$ and check the ciphertext against that, and if they match, $m=x$. IMO you're just removing two possible values of $m$ for no good reason.
Apr 8 '15 at 15:54 comment added Ruggero Here RSA is used without padding. The encryption of m=0 would be $0^e=0$. Anyone intercepting the ciphertext will know the value of m. Therefore it is not secure to use m=0. The same argument works for m=1, ciphertext will be 1.
Apr 8 '15 at 15:52 comment added thejh Why 1 < m and not 0 <= m?
Oct 14 '14 at 7:35 history answered Ruggero CC BY-SA 3.0