Timeline for If RSA is only used to encrypt symmetric keys which are random, what's wrong with textbook RSA?
Current License: CC BY-SA 4.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 1, 2021 at 4:21 | history | edited | Patriot | CC BY-SA 4.0 |
removed internet slang because it might confuse some readers; concision
|
| Jun 27, 2017 at 12:52 | vote | accept | wlad | ||
| Jul 8, 2015 at 10:24 | history | tweeted | twitter.com/#!/StackCrypto/status/618727404756946944 | ||
| Jul 7, 2015 at 17:39 | comment | added | SEJPM | We want as much security as we can have (with "negligible" effort). Just to be sure. Textbook RSA by itself isn't even IND-CPA, because you can find low-entropy messages by trying them out (=academically broken). If you also consider this: Assuming you use e=3 and send the exact same message to three other people (hybrid encryption, one symmetric key), then everyone having all three (encrypted) messages can read the message. | |
| Jul 7, 2015 at 17:33 | answer | added | Yehuda Lindell | timeline score: 22 | |
| Jul 7, 2015 at 17:19 | history | edited | wlad | CC BY-SA 3.0 |
[Edit removed during grace period]
|
| Jul 7, 2015 at 17:07 | comment | added | wlad | @SEJPM so for random session keys, textbook RSA is CPA-secure but not CCA-secure and it's the latter we want. | |
| Jul 7, 2015 at 17:06 | comment | added | SEJPM | ... and please don't forget. The scheme broken by Bleichenbacher was way stronger than textbook RSA. | |
| Jul 7, 2015 at 16:58 | comment | added | SEJPM | This would still be vulnerable to CCA attacks and was at least exploited once. So we make sure we miss nothing and it's always secure and make it IND-CCA2 (by using OAEP) | |
| Jul 7, 2015 at 16:49 | history | asked | wlad | CC BY-SA 3.0 |