Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now

Questions tagged [public-key]

An asymmetric cipher is an encryption scheme using a pair of keys, one to encrypt and a second to decrypt a message. This way the encrypting key need not be kept secret to ensure a private communication. Similarly in public key authentication, the verification key can be public and the signing key private.

Filter by
Sorted by
Tagged with
16
votes
2answers
16k views

Where and how to store private keys in web applications for private messaging with web browsers

I am working on a web application enabling users to communicate over private messages which is just one part of the whole system. The main focus during my development process is to protect the privacy ...
15
votes
4answers
3k views

Which public key cryptosystems are not based on number theory?

Are there any public key cryptographic systems whose hardness assumptions don't involve number theoretic problems?
15
votes
2answers
2k views

NIST Diffie-Hellman prime: how was it picked? Where did it come from?

According to this Matasano Crypto challenge, the NIST "likes" the following prime modulus, which appears to be expressed in hexadecimal: ...
15
votes
3answers
2k views

Are there asymmetric cryptographic algorithms that are not based on integer factorization and discrete logarithm?

In the computer security class (in which cryptography is a big chapter) that I took, I remembered the professor said about current asymmetric cryptography algorithms are based on integer factorization ...
15
votes
1answer
4k views

What are the benefits of lattice based cryptography?

Previously we visited the benefits of elliptic curves for cryptography. Lattice based cryptography is starting to become quite popular in academia. The primary benefit of lattice based crypto is the ...
15
votes
5answers
3k views

Is there an intuitive explanation as to why only the private key can decrypt a message encrypted with the public key?

I have just learned about using PGP/GPG for email encryption and one thing bugs me: How is it possible that a message encrypted with somebody's public key can be decrypted only with that person's ...
15
votes
2answers
8k views

How can I remove my personal data from my PGP public key?

According to this Q&A-discussion it is possible to remove all personal data (name and mail address) that is attached to a public key. What steps do I have to follow in order to remove all ...
15
votes
3answers
2k views

Is there any more information on this RSA backdoor?

Someone posted an article on Reddit a few days ago, and I haven't found much about it except for links back to the same page. And for a brief summary, essentially, it's possible to introduce a ...
15
votes
2answers
2k views

How do I get the equivalent strength of an ECC key?

I know how to calculate the comparable symmetric strength of an RSA modulus: calculate the running time for a field sieve. This is how NIST gives approximate symmetric sizes for asymmetric algos in ...
15
votes
1answer
2k views

What is a (smooth) projective hash function?

I recently came across the term "smooth projective hash function", and I see that there are many constructions nowadays that rely on them, especially some PAKE constructions. But, I didn't exactly ...
15
votes
1answer
481 views

How to create a decentralized secret ballot among a small group of people?

A small (< 100) group wants to implement an election. For that, each participant must vote in one of N candidates. After everyone has voted, they must be able to determine a winner; yet, nobody ...
14
votes
3answers
1k views

Does NTRU decrypt correctly now?

The NTRU public-key cryptosystem has a lot of interesting properties (being resistant to quantum computer attacks, being standardized by several important bodies), but it also has a pretty unique ...
14
votes
2answers
2k views

Why does key generation take an input $1^k$, and how do I represent it in practice?

In my lecture, the lecturer said: Let $K$ be the key generation algorithm. Given a security parameter represented in unary, $1^k$, $K(1^k)$ will output a keypair $(pk; sk)$, known as the public ...
14
votes
2answers
7k views

Is RSA encryption with a private key the same as signature generation?

It is often said that RSA encryption of a cryptographic hash with a private key is the same as signing (signature generation). And that verification consists of decryption using a public key. Is RSA ...
14
votes
3answers
6k views

ElGamal: Multiplicative cyclic group and key generation

Here on the ElGamal wikipedia page http://en.wikipedia.org/wiki/ElGamal_encryption Alice generates an efficient description of a multiplicative cyclic group G, of order q, with generator g. How ...
14
votes
4answers
2k views

Are any of the major asymmetric ciphers distinguishable (EG, RSA, ECC)?

Related to "Is it possible to derive the encryption method from encrypted text?". Given ciphertexts generated by any of the major asymmetric ciphers (RSA, ElGamal, ECC, etc..) can these ciphertexts ...
14
votes
1answer
1k views

How to build an electro-mechanical public key cipher machine?

It is generally assumed that asymmetric encryption schemes were invented in 1973 at GCHQ in Britain and, independently, in 1976 at the MIT. Imagine, if the abstract idea of having a public key and a ...
14
votes
1answer
677 views

Verbatim of early work on public-key cryptography?

In late 1997, the history of public-key cryptography was turned around with the announcement (then extended) that public-key cryptography was theorized in a 1970 note [1] by James Henry Ellis: The ...
13
votes
6answers
10k views

What is the importance of Modular arithmetic in cryptography?

Why do we use modular arithmetic so often in Cryptography?
13
votes
2answers
5k views

Can two different pairs of RSA key have the same modulus?

Can $n=pq$ be part of two different pairs of RSA keys? If such keys exist, say $(e_1,n)$ and $(e_2,n)$, how are they related? What will be the security concerns for the two users?
13
votes
2answers
2k views

Can a computationally unbounded adversary break any public-key encryption scheme?

Assume there is a public-key encryption scheme $(KeyGen, Enc, Dec)$ with perfect correctness (i.e., for all messages M and valid key-pairs (PK,SK), we have $Dec_{SK}(Enc_{PK}(M))=M$). Will there ...
13
votes
3answers
6k views

How many KDF rounds for an SSH key?

What is the best practice on choosing how many key derivation function (KDF) rounds/iterations when generating an SSH key pair with ssh-keygen? Am I correct in saying that it is unnecessary if the ...
13
votes
1answer
14k views

Advantages using Diffie-Hellman or ElGamal

For what kind of usage should we prefer using Diffie-Hellman in order to exchange keys instead of ElGamal, and most important why should we use one or the other? I do not see a clear difference ...
13
votes
2answers
4k views

Cycle attack on RSA

I originally posted this question in the mathematics section, you can see it here. Let $p$ and $q$ be large primes, $n=pq$ and $e : 0<e<\phi(n), \space gcd(e, \phi(n))=1$ the public encyption ...
13
votes
2answers
683 views

Is it safe to reuse a ECDSA nonce for two signatures if the public keys are different?

We denote the s value of an ECDSA signature $(r, s)$ on a message $m$ as: $s=\frac{H(m)+xr}{k}$ Assume two ECDSA signatures sharing the same nonce $(r, s_1) , (r, s_2)$ on two messages $m_1, m_2$, ...
12
votes
4answers
3k views

Efficient hardware implementation of real-time asymmetric video encryption

I want to encrypt video directly at the source where it is being captured, e.g. inside a video camera. This way I can transmit the encrypted stream over WiFi securely. I could use AES on the chip ...
12
votes
3answers
8k views

What is Identity-Based Encryption (IBE) and why is it “better”?

Most CS/Math undergrads run into the well-known RSA cryptosystem at some point. But about 10 years ago Boneh and Franklin introduced a practical Identity-Based Encryption system (IBE) that has ...
12
votes
2answers
5k views

Can or can not D-Wave's quantum computers use Shor's and Grover's Algorithm to find encryption keys? Why?

I read that a company called D-Wave Systems has and is manufacturing quantum computers of 128 qubits. Can they or can they not use Shor's and Grover's algorithms for finding RSA-keys? If they can't ...
12
votes
2answers
1k views

Are there any signature schemes for underpowered devices (8-bit microcontroller)?

I am currently researching into a small scale home automation system, aiming for cost. The system architecture is basically one master and several slaves which are connected in parallel. Recently i'...
12
votes
1answer
3k views

Why do we encrypt-then mac but sign-then-encrypt?

This question was asked in comments on my answer to should we sign then encrypt or encrypt then sign. I think posing the question as a separate entity is best, so: The general advice for applying ...
12
votes
2answers
708 views

How should one implement a delegated shared trust protocol?

Consider the following (probably naive) scenario. Alice, who is very limited in her knowledge of security in general (clueless about securing a private key for example), wishes to delegate certain ...
12
votes
0answers
582 views

Given a 'good' basis for a lattice, how can we solve the CVP?

I'm doing a little bit of reading about lattices. I read that if we can find a 'short' basis for our given lattice, we can solve CVP and SVP very efficiently. However, the paper didn't describe an ...
11
votes
3answers
13k views

Why can’t DSA be used for encryption?

This question at StackOverflow mentions that DSA cannot be used for encryption. But both RSA and DSA can be used to generate public and private keys, right? Then why can't I use the DSA public key to ...
11
votes
1answer
2k views

After ECDH with Curve25519, is it pointless to use anything stronger than AES128?

Is the following reasoning correct: After ECDH with Curve25519, the resulting shared secret will be an EC public key with a bit strength of 128 bits. This public key would then be hashed (let's say ...
11
votes
4answers
2k views

What is the malicious potential of a key-substitution-attack?

What is the idea behind a key-substitution-attack? We start from a given pair of message $m$ and signature $s(m)$. The signature can be verified by anybody in possess of the public key $y$: $v(m, s, ...
11
votes
1answer
12k views

how to use common modulus attack?

I am struck with the following problem: Let Alice, Bob, Chris and Eve communicate over a public network. They encrypt all messages they send using RSA system. Bob and Chris have the RSA modulus $...
11
votes
3answers
416 views

Is it possible to create an asymmetric cryptosystem where the private keys are not easily verifiable as such?

Plaintext that consists of an RSA key is easily recognizable as such, because it satisfies certain mathematical properties, in particular (See the answer for Why can an encrypted private key be brute ...
11
votes
2answers
830 views

Given enough RSA signature values, is it possible to determine the public key value?

Given enough RSA signature values, is it possible to determine which public key is required to verify the values? Could there be enough information to establish which key is required? Is there ...
11
votes
1answer
197 views

How does the process of creating a new secure Elliptic Curve look like?

I'm especially curious about the technique djb would have used to come up with his Curve 25519. Say I have already written down my goals, such as - Twist Secure, Speed, Side Channel resistance, etc. ...
11
votes
2answers
6k views

Deterministically generate a RSA public/private key pair from a passphrase (with sufficient entropy)?

Is it possible to deterministically generate public/private RSA key pairs from passphrases? Would giving the (key generating) algorithm data made from key-stretching the passphrase (instead of a ...
11
votes
1answer
605 views

Alice trusts Bob only when Bob trusts Alice

some story first: Alice and Bob both have public/private key pairs. Now Bob wants Alice to sign his public key id. Alice agrees but only when Bob signs the public key id of her. Is this something ...
11
votes
1answer
2k views

Using a single Ed25519 key for encryption and signature

The libsodium documentation contains a function crypto_sign_ed25519_pk_to_curve25519 that converts an Ed25519 key into a Curve25519 one, so it can be used for both ...
11
votes
1answer
208 views

Is the Couvreur et al. polynomial time attack on McEliece practical?

There's a new e-print out on arXiv titled "A Polynomial Time Attack against Algebraic Geometry Code Based Public Key Cryptosystems" by Alain Couvreur, Irene Márquez-Corbella and Ruud Pellikaan: "We ...
11
votes
0answers
212 views

Is there a pen-and-paper way to securely share a secret via public key encryption? [duplicate]

We have several questions tagged pen-and-paper talking about encryption, hashing, signing, etc. but no question asks about exchanging a secret via public key encryption in a secure way. Does any ...
10
votes
4answers
1k views

Is key size the only barrier to the adoption of the McEliece cryptosystem, or is it considered broken/potentially vulnerable?

A recent paper showed that the McEliece cryptosystem is not, unlike RSA and other cryptosystems, weakened as drastically by quantum computing because strong Fourier sampling cannot solve the hidden ...
10
votes
3answers
2k views

Asymmetry between public key and private key: digital signatures use the private key for “encryption”?

I have a misunderstanding concerning public key cryptography...would be very helpful if you answer the questions... Digital signatures: You use your private key for "encryption" and they use your ...
10
votes
3answers
641 views

Can one have an authentic, but repudiable, message without a previously shared secret?

Bob wants to send a message to Alice, such that Alice can be sure that the message came from Bob, but can't prove it to anyone else. If I understand right, this means that the same message could have ...
10
votes
2answers
2k views

How do malware rely safely on ECDH algorithm to maintain secrecy of keys?

In traditional malware (especially ransomware) using RSA approach, the public key may be hard-coded in the malware binary and is used to encrypt a symmetric key generated on the system. The symmetric ...
10
votes
2answers
611 views

Modular Inverse as a Problem

Given a modulus $N$ and a number $a$, a multiplicative inverse exists for $a$ if $a$ and $N$ are coprime. Why isn’t there a cryptosystem that uses this as a computational problem? Example Alice and ...
10
votes
1answer
1k views

If RSA is only used to encrypt symmetric keys which are random, what's wrong with textbook RSA?

IND-CPA is used to protect against frequency analysis AFAICT. But if RSA is only used to encrypt symmetric keys (AFAICT) then what's wrong with using only textbook RSA because random keys are very ...