I have a protocol where I have a random one-time number message $m \in \mathbb{Z}_p$, where $p$ is a 256 bit prime from an Elliptic Curve (EDIT: The order of an elliptic curve prime order group). I also have a textbook RSA ciphertext $m^e \mod n$, encrypted using a 2048 bit RSA key. I am using for its homomorphic properties (I can't pad it or the protocol will not work).

Is it safe to use using a message from a large message space that is smaller than the RSA group size?

(EDIT in response to comment): I am not stuck with any particular value for $e$, but my program does scale with $\log_2{(e)}$, so I would prefer something smaller.

  • $\begingroup$ Here the value of $e$ is important. If $e=3$ a direct cube-root attack is possible. What is the value of $e$? $\endgroup$
    – kelalaka
    Nov 24, 2023 at 22:34
  • $\begingroup$ I'm not bound to any particular value for $e$, though I would prefer for it to not use too many bits. $e = 65537$ should be fine, but I can also go larger if that would be safer. $\endgroup$
    – Zarquan
    Nov 24, 2023 at 23:03
  • $\begingroup$ what's a "prime p from an Elliptic curve?" $\endgroup$
    – kodlu
    Nov 25, 2023 at 4:38
  • $\begingroup$ What I meant is the prime order from an elliptic curve. $\endgroup$
    – Zarquan
    Nov 25, 2023 at 4:43
  • 2
    $\begingroup$ The present question seems to be a small variation of this one. $\endgroup$
    – fgrieu
    Nov 25, 2023 at 6:39


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.