Questions tagged [public-key]
An asymmetric cipher is an encryption scheme using a pair of keys, one to encrypt and a second to decrypt a message. This way the encrypting key need not be kept secret to ensure a private communication. Similarly in public key authentication, the verification key can be public and the signing key private.
273
questions
117
votes
6answers
77k views
Should we sign-then-encrypt, or encrypt-then-sign?
We regularly want to send messages that are both (a) encrypted, so passive attackers can't discover the plaintext of the message, and (b) signed with a private-key digital signature, so active ...
115
votes
7answers
68k views
How big an RSA key is considered secure today?
I think 1024 bit RSA keys were considered secure ~5 years ago, but I assume that's not true anymore. Can 2048 or 4096 keys still be relied upon, or have we gained too much computing power in the ...
38
votes
5answers
16k views
Does RSA work for any message M?
I decided to read the original RSA paper A Method for Obtaining Digital Signatures and Public-Key Cryptosystem because of a question I had about RSA (which is not the question I'm about to ask, but ...
47
votes
3answers
34k views
Definition of textbook RSA
What is the definition of textbook or "raw" RSA?
What are some of the properties of textbook RSA?
How does it differ from other schemes based on RSA?
20
votes
2answers
8k views
Is RSA encryption with a private key the same as signature generation?
It is often said that RSA encryption of a cryptographic hash with a private key is the same as signing (signature generation). And that verification consists of decryption using a public key.
Is RSA ...
61
votes
1answer
46k views
Can you explain Bleichenbacher's CCA attack on PKCS#1 v1.5?
I've studied that the Bleichenbacher's CCA attack on PKCS#1 v1.5. is a base to many versions of attacks in the area.
I'm trying to understand that attack, but every explanation I saw starts with the ...
67
votes
4answers
34k views
How can I use asymmetric encryption, such as RSA, to encrypt an arbitrary length of plaintext?
RSA is not designed to be used on long blocks of plaintext like a block cipher, but I need to use it to send a large (encrypted) message.
How can I do this?
55
votes
8answers
56k views
How does asymmetric encryption work?
I've always been interested in encryption but I have never found a good explanation (beginners explanation) of how encryption with public key and decryption with private key works.
How does it ...
16
votes
1answer
2k views
After ECDH with Curve25519, is it pointless to use anything stronger than AES-128?
Is the following reasoning correct:
After ECDH with Curve25519, the resulting shared secret will be an EC public key with a bit strength of 128 bits.
This public key would then be hashed (let's say ...
47
votes
3answers
93k views
RSA encryption with private key and decryption with a public key
When using the RSA cryptosystem, does it still work if you instead encrypt with the private key and decrypt with the public key? What about in the case of using RSA for sender authentication?
28
votes
2answers
28k views
Why is asymmetric cryptography bad for huge data?
I've been told that asymmetric cryptography requires that the message to be encrypted be smaller than its key length.
Why is this?
I know about hybrid encryption, which uses symmetric encryption to ...
68
votes
5answers
31k views
How are primes generated for RSA?
As I understand it, the RSA algorithm is based on finding two large primes (p and q) and multiplying them. The security aspect is based on the fact that it's difficult to factor it back into p and q. ...
62
votes
3answers
41k views
Impacts of not using RSA exponent of 65537
This RFC says the RSA Exponent should be 65537. Why is that number recommended and what are the theoretical and practical impacts & risks of making that number higher or lower?
What are the ...
15
votes
2answers
2k views
Why does key generation take an input $1^k$, and how do I represent it in practice?
In my lecture, the lecturer said:
Let $K$ be the key generation algorithm. Given a security parameter represented in unary, $1^k$, $K(1^k)$ will output a keypair $(pk; sk)$, known as the public ...
12
votes
1answer
14k views
how to use common modulus attack?
I am struck with the following problem:
Let Alice, Bob, Chris and Eve communicate over a public network. They encrypt all messages they send using RSA system. Bob and Chris have the RSA modulus $n_B$ ...
158
votes
4answers
107k views
Why is elliptic curve cryptography not widely used, compared to RSA?
I recently ran across elliptic curve crypto-systems:
An Introduction to the Theory of Elliptic Curves (Brown University)
Elliptic Curve Cryptography (Wikipedia)
Performance analysis of identity ...
22
votes
5answers
24k views
Why is it important that phi(n) is kept a secret, in RSA?
Why is it important that $\phi(n)$ is kept a secret, in RSA?
43
votes
3answers
27k views
Why is public-key encryption so much less efficient than secret-key encryption?
I'm currently reading Cryptography Engineering. After giving a high level explanation of the difference between secret-key encryption and public-key encryption, the book says:
So why do we bother ...
13
votes
2answers
3k views
Can a computationally unbounded adversary break any public-key encryption scheme?
Assume there is a public-key encryption scheme $(KeyGen, Enc, Dec)$ with perfect correctness (i.e., for all messages M and valid key-pairs (PK,SK), we have $Dec_{SK}(Enc_{PK}(M))=M$).
Will there ...
31
votes
4answers
28k views
How can one securely generate an asymmetric key pair from a short passphrase?
Background info:
I am planning on making a filehost with which one can encrypt and upload files. To protect the data against any form of hacking, I'd like not to know the encryption key ($K$) used for ...
80
votes
10answers
16k views
In end-to-end encryption, doesn't the server need to be trusted?
Applications like WhatsApp use end to end encryption. WhatsApp says that only the users share a specific key and no third party can view the messages. But I do not understand how the two users agree ...
20
votes
4answers
10k views
Is sharing the modulus for multiple RSA key pairs secure?
In the public-key system RSA scheme, each user holds beyond a public modulus $m$ a public exponent, $e$, and a private exponent, $d$.
Suppose that Bob's private exponent is learned by other users. ...
25
votes
2answers
3k views
Why is PuTTYgen-created RSA public exponent(e) not in {3,17,65537}?
As far as I know, RSA public exponent(e) should be one of {3,17,65537}.
However, I found PuTTYgen-created RSA public exponent(e) is 0x25(37) by default,as follows, (PuTTYgen version: 0.66)
I am ...
25
votes
9answers
19k views
RSA with small exponents?
Just to establish notation with respect to the RSA protocol, let $n = pq$ be the product of two large primes and let $e$ and $d$ be the public and private exponents, respectively ($e$ is the inverse ...
21
votes
1answer
1k views
Security of RSA for paranoids with padding?
RSA for Paranoids (RSAP) (in CryptoBytes v1n3), also known as Unbalanced RSA, is a variant of RSA proposed in 1995 by Adi Shamir, as a mean to increase the RSA public modulus size while keeping ...
10
votes
1answer
374 views
Could this “symmetric RSA” scheme provide key compromise resistant communications?
This question, and fkraiem's answer to it, made me wonder about the security and practicality of using "symmetric RSA" to provide a partially compromise-resistant secure channel.
Specifically, assume ...
61
votes
1answer
6k views
Why does my SSH private key still work after changing some bytes in the file?
I (for a test) just randomly altered a private RSA key by opening it up in Vim and changing a few bytes. It is the private part of an SSH key pair used for logging in on a remote system. Puzzlingly, ...
16
votes
2answers
31k views
What makes RSA secure by using prime numbers?
I am just learning about the RSA algorithm. Looking at the first two steps:
Choose two distinct prime numbers $p$ and $q$.
Compute $n = pq$.
I have some probably stupid questions:
Why do $p$ and $...
25
votes
2answers
38k views
How much computing resource is required to brute-force RSA?
It's been over 30 years since Rivest, Shamir and Adleman first publicly described their algorithm for public-key cryptography; and the intelligence community is thought to have known about it for ...
14
votes
1answer
741 views
Verbatim of early work on public-key cryptography?
In late 1997, the history of public-key cryptography was turned around with the announcement (then extended) that
public-key cryptography was theorized in a 1970 note [1] by James Henry Ellis: The ...
10
votes
3answers
4k views
Is RSA in a ECB-like-mode safe for bulk encryption?
Let's say I would like to communicate with my friend using asymmetric/public-key encryption, e.g. RSA.
(Note: I do realize that in practice this is done through an intermediate symmetric key, but ...
3
votes
2answers
10k views
Why is hybrid encryption more effective than other encryption scheme?
Currently I am learning about Hybrid Encryption but I was not able to find any good study material.
Below is my understanding:
One of the reason why we use ...
2
votes
2answers
1k views
Factors of RSA modulus
In the article A Method for Obtaining Digital Signatures and Public-Key Cryptosystems, the original RSA article, it is mentioned that Miller has shown that n (the modulus) can be factored using any ...
21
votes
2answers
25k views
How does a chosen plaintext attack on RSA work?
How can one run a chosen plaintext attack on RSA?
If I can send some plaintexts and get the ciphertexts, how can I find a relation between them which helps me to crack another ciphertext?
7
votes
1answer
4k views
Is a known plaintext, ciphertext, and public-key a viable attack on RSA?
Assume Alice and Bob are using RSA to create a common session key and Cindy is listening, attempting to obtain the session key.
Alice and Bob each have their public- and private-key pairs ($\left[...
14
votes
2answers
4k views
Cycle attack on RSA
I originally posted this question in the mathematics section, you can see it here.
Let $p$ and $q$ be large primes, $n=pq$ and $e : 0<e<\phi(n), \space gcd(e, \phi(n))=1$ the public encyption ...
12
votes
1answer
11k views
How does encryption work in elliptic curve cryptography?
So I think I understand a good amount of the theory behind elliptic curve cryptography, however I am slightly unclear on how exactly a message in encrypted and then how is it decrypted.
So my ...
10
votes
1answer
622 views
Hash-based asymmetrical encryption (not digital signature) schemes?
In the Wikipedia article or another article about post-quantum crypto there's a plenty of information about hash-based signatures. But where are hash-based ecryption with pubkey?
But, over the long-...
16
votes
4answers
8k views
Why does the recommended key size between symmetric and asymmetric encryption differ greatly?
In various articles it is mentioned that for secure communications, the recommended key sizes are 128-bit key size for symmetric encryption (which makes it $2^{128}$ possible keys?) and 2048-bit key ...
6
votes
1answer
1k views
What does the $\|$ operation mean in cryptographic notation?
I am studying elliptic curves problems, which also includes study of related protocols such as ECIES. The problem is that I don't understand the notation $\|$. What does this operation mean?
Some ...
4
votes
1answer
2k views
How to calculate RSA CRT parameters from public key and private exponent
Given the public key (n, e) and private exponent (d), how to calculate CRT parameters (p, q, dP, dQ, and qInv) of this RSA key pair?
3
votes
2answers
412 views
Bruce Schneier, encryption, public keys and digital-signature.
In his book "Applied Cryptography" Bruce Schneier, when talking about public key cryptography, says that:
If the same algorithm is used for both encryption and digital-signature verification there ...
0
votes
2answers
995 views
Homomorphic Encryption: how does the equality test on ciphertexts work?
Let's suppose we have a asymmetric crypto-system $H$ which is homomorphic with respect to some function $F$.
Alice encrypts a message $m$ with her private key $e$ in the crypto-system $H$ and obtains ...
40
votes
4answers
34k views
Basic explanation of Elliptic Curve Cryptography?
I have been studying Elliptic Curve Cryptography as part of a course based on the book Cryptography and Network Security. The text for provides an excellent theoretical definition of the algorithm but ...
40
votes
5answers
124k views
What is the SSL private key file format?
I was researching about how to encrypt with RSA. I understood everything but not the format of the private keys.
In the phpseclib (RSA in PHP), you can import your private key (private.key format) ...
34
votes
2answers
39k views
What's the fundamental difference between Diffie-Hellman and RSA?
What is the difference in the purpose of DH and RSA? Aren't they both public-key encryption?
19
votes
1answer
28k views
Low Public Exponent Attack for RSA
I'm having trouble understanding the algorithm for finding the original message $m$, when there is a small public exponent. Here is the example I'm trying to follow (you can also read it in the 'Low ...
13
votes
1answer
15k views
Advantages using Diffie-Hellman or ElGamal
For what kind of usage should we prefer using Diffie-Hellman in order to exchange keys instead of ElGamal, and most important why should we use one or the other?
I do not see a clear difference ...
12
votes
2answers
7k views
Deterministically generate a RSA public/private key pair from a passphrase (with sufficient entropy)?
Is it possible to deterministically generate public/private RSA key pairs from passphrases?
Would giving the (key generating) algorithm data made from key-stretching the passphrase (instead of a ...
14
votes
6answers
12k views
What is the importance of Modular arithmetic in cryptography?
Why do we use modular arithmetic so often in Cryptography?
