Timeline for Is it possible to get an RSA encryption key by comparing the unencrypted and encrypted file?
Current License: CC BY-SA 3.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Dec 14, 2017 at 1:51 | comment | added | woojoo666 | so you're saying that, if we only had the ciphertext and somehow computed all possible RSA public keys (assuming size < 2048), then encrypting the plaintext with any one of these keys would always result in the ciphertext? | |
| Aug 20, 2015 at 5:00 | comment | added | Yehuda Lindell | @SEJPM Nice! I like the method for finding N. | |
| Aug 19, 2015 at 13:24 | comment | added | SEJPM | I can find $N$ with high probability as the GCD of the results of the left side of the equation. See my answer for the details on how many known plaintexts are needed. | |
| Aug 18, 2015 at 12:58 | comment | added | Yehuda Lindell | Textbook RSA is not secure encryption. My proof is for something that is secure encryption. In any case, how do you know $N$ exactly? | |
| Aug 18, 2015 at 7:01 | comment | added | SEJPM | Well, let's quickly assume textbook RSA. Assume you're given two messages $m_1,m_2$ and two ciphertexts $c_1,c_2$. Now guess a value for $e$ (chances won't be too bad for $e<2^40$) and observe that $c\equiv m^e \pmod N$. Now use this to obtain the relation $m^e-c=rN$. Calculate the left side for all known plaintexts and compute the pair-wise GCD between them. The smallest result will likely be the modulus. Verify your guess by trying the public key parameters at additional known plaintexts. | |
| Aug 18, 2015 at 5:51 | history | answered | Yehuda Lindell | CC BY-SA 3.0 |