I would like to use unpadded RSA for homomorphic encryption in a toy P2P game, for things like fair coin flips and shuffling.

How many bits of security does unpadded RSA have, in relation to its key size?

  • 3
    $\begingroup$ I don't think you are asking the right question. It isn't the "bits of security" I would be worried about, it is the lack of semantic security of unpadded RSA that would concern me. So, if you need a multiplicatively homomorphic cryptosystem, I'd say, stick with ElGamal. $\endgroup$
    – mikeazo
    Oct 1, 2012 at 16:01

1 Answer 1



When enciphering any small set of values (including a fair coin flip, a byte, even a small password..), unpadded RSA (or RSA with any padding that does not include randomness) is a terminally weak encryption method: the adversary can enumerate the possible plaintext values, encrypt them using the public key, and check against the ciphertext to determine if the candidate plaintext value being enumerated is the right one.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.