I would like to use unpadded RSA for homomorphic encryption in a toy P2P game, for things like fair coin flips and shuffling.
How many bits of security does unpadded RSA have, in relation to its key size?
$\begingroup$
$\endgroup$
1
-
3$\begingroup$ I don't think you are asking the right question. It isn't the "bits of security" I would be worried about, it is the lack of semantic security of unpadded RSA that would concern me. So, if you need a multiplicatively homomorphic cryptosystem, I'd say, stick with ElGamal. $\endgroup$– mikeazoOct 1, 2012 at 16:01
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
0
None.
When enciphering any small set of values (including a fair coin flip, a byte, even a small password..), unpadded RSA (or RSA with any padding that does not include randomness) is a terminally weak encryption method: the adversary can enumerate the possible plaintext values, encrypt them using the public key, and check against the ciphertext to determine if the candidate plaintext value being enumerated is the right one.
