Timeline for If RSA is only used to encrypt symmetric keys which are random, what's wrong with textbook RSA?
Current License: CC BY-SA 3.0
14 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 11, 2023 at 7:04 | comment | added | Galois group | Thank you for you answer! However you do not really convinced me. Well, what is the problem to use random $e$ and 512 bit long keys? Then it seems everything would be secure. At least I don't see any practical attack. | |
| Jun 27, 2017 at 12:52 | vote | accept | wlad | ||
| Jul 8, 2015 at 12:09 | comment | added | Yehuda Lindell | What do you mean by a random key? I assume that you mean that you take a random string of length say 256 and then apply the RSA function to it. In this case, the first attack works with probability 1 (up to 682 bits long). | |
| Jul 8, 2015 at 9:24 | comment | added | wlad | If you're encrypting a random key then the probability of the first attack working is $2^{682 - 2048}$ which is extremely small. Same for the second attack. The problem I see now is when the random key is at most $682$ bits long, because $682$ bits is quite a lot for a symmetric key, in which case some padding is necessary to prevent the attack. It's important to refer back to the question I asked. | |
| Jul 7, 2015 at 21:05 | history | edited | Yehuda Lindell | CC BY-SA 3.0 |
added 88 characters in body
|
| Jul 7, 2015 at 21:01 | comment | added | Maarten Bodewes♦ | Just to be sure; isn't the first to last paragraph describing KEM with the hash replacing a KDF? Maybe you could somehow link KEM with this paragraph in the answer? | |
| Jul 7, 2015 at 20:59 | history | edited | Maarten Bodewes♦ | CC BY-SA 3.0 |
added 6 characters in body
|
| Jul 7, 2015 at 20:49 | history | edited | Yehuda Lindell | CC BY-SA 3.0 |
Removed space and added references
|
| Jul 7, 2015 at 20:44 | comment | added | Yehuda Lindell | Thanks, I actually don't think I knew about this, so this is really important! | |
| Jul 7, 2015 at 20:37 | comment | added | user991 | By the link I gave, both instances of "and space" should be removed. $\;$ | |
| Jul 7, 2015 at 20:25 | history | edited | Yehuda Lindell | CC BY-SA 3.0 |
Added attack when e=3
|
| Jul 7, 2015 at 20:19 | comment | added | Yehuda Lindell | @RickyDemer Thanks; forgot to include that. Will edit now. | |
| Jul 7, 2015 at 17:56 | comment | added | user991 | For small $e$, there's an even faster attack. $\:$ Even for large $e$, the amount of space used can be made trivial. $\:\:$ | |
| Jul 7, 2015 at 17:33 | history | answered | Yehuda Lindell | CC BY-SA 3.0 |