Questions tagged [public-key]

An asymmetric cipher is an encryption scheme using a pair of keys, one to encrypt and a second to decrypt a message. This way the encrypting key need not be kept secret to ensure a private communication. Similarly in public key authentication, the verification key can be public and the signing key private.

Filter by
Sorted by
Tagged with
12
votes
4answers
2k views

What is the malicious potential of a key-substitution-attack?

What is the idea behind a key-substitution-attack? We start from a given pair of message $m$ and signature $s(m)$. The signature can be verified by anybody in possess of the public key $y$: $v(m, s, ...
12
votes
2answers
1k views

Are there any signature schemes for underpowered devices (8-bit microcontroller)?

I am currently researching into a small scale home automation system, aiming for cost. The system architecture is basically one master and several slaves which are connected in parallel. Recently i'...
12
votes
1answer
3k views

Relation between Key-exchange and Public-Key encryption schemes

Recently we have seen a lot of papers on Post-quantum key-establishment (key encapsulation mechanism or Key-exchange), largely due to the standardization call of NIST for PQ-protocols. However, most ...
12
votes
2answers
8k views

How does a certificate authority issue a digital certificate?

I am new to cryptography and I want to know the details of how a Certificate Authority issues a digital certificate. From what I know (please correct me if I'm wrong at any parts of my explanation): ...
12
votes
3answers
19k views

How does a client verify a server certificate?

As far as I know, when I request a certificate from Verisign (for example), and after they approved that I is me, they create a certificate (for me) that contains the digital signature and public key. ...
12
votes
2answers
815 views

How should one implement a delegated shared trust protocol?

Consider the following (probably naive) scenario. Alice, who is very limited in her knowledge of security in general (clueless about securing a private key for example), wishes to delegate certain ...
11
votes
5answers
3k views

Suppose I capture encrypted data that I want to decrypt. Could I use a server farm to decrypt?

For argument's sake, let's say that I'm a bad actor who produces malware. I've infected around 10,000 computers and smartphones with my malware, which runs in the background and can be used to make ...
11
votes
4answers
1k views

Is key size the only barrier to the adoption of the McEliece cryptosystem, or is it considered broken/potentially vulnerable?

A recent paper showed that the McEliece cryptosystem is not, unlike RSA and other cryptosystems, weakened as drastically by quantum computing because strong Fourier sampling cannot solve the hidden ...
11
votes
3answers
3k views

Asymmetry between public key and private key: digital signatures use the private key for “encryption”?

I have a misunderstanding concerning public key cryptography...would be very helpful if you answer the questions... Digital signatures: You use your private key for "encryption" and they use your ...
11
votes
3answers
18k views

Why can’t DSA be used for encryption?

This question at StackOverflow mentions that DSA cannot be used for encryption. But both RSA and DSA can be used to generate public and private keys, right? Then why can't I use the DSA public key to ...
11
votes
3answers
428 views

Is it possible to create an asymmetric cryptosystem where the private keys are not easily verifiable as such?

Plaintext that consists of an RSA key is easily recognizable as such, because it satisfies certain mathematical properties, in particular (See the answer for Why can an encrypted private key be brute ...
11
votes
1answer
9k views

Can an RSA private key have several public keys?

Ok, so my cryptography lecturer in University posed this question at the end of the RSA key generation lecture as a brain teaser. I have been thinking about this and I think I have come up with a way ...
11
votes
2answers
5k views

What's the difference between rsa_pss_pss_* and rsa_pss_rsae_* schemes?

I'm trying to understand the difference between rsa_pss_pss_ and rsa_pss_rsae_. The picture shows the extension of TLS1.3's ...
11
votes
2answers
1k views

Given enough RSA signature values, is it possible to determine the public key value?

Given enough RSA signature values, is it possible to determine which public key is required to verify the values? Could there be enough information to establish which key is required? Is there ...
11
votes
1answer
3k views

When/why is RSA (hybrid) encryption used rather than alternatives?

I've read that RSA is not meant for encrypting large plaintext because: (Are these also true for other public-key encryptions like ElGamal?) It is slow. Padding makes the ciphertext blocks much ...
11
votes
3answers
22k views

Using ECDSA keys for encryption

I know that ECDSA is used for signature only, but I wonder if I can use the public/private Elliptic Curve keys for encryption too. I have ECDSA SSH public keys and I wonder if I can use them to ...
11
votes
1answer
272 views

How does the process of creating a new secure Elliptic Curve look like?

I'm especially curious about the technique djb would have used to come up with his Curve 25519. Say I have already written down my goals, such as - Twist Secure, Speed, Side Channel resistance, etc. ...
11
votes
1answer
706 views

Alice trusts Bob only when Bob trusts Alice

some story first: Alice and Bob both have public/private key pairs. Now Bob wants Alice to sign his public key id. Alice agrees but only when Bob signs the public key id of her. Is this something ...
11
votes
1answer
221 views

Is the Couvreur et al. polynomial time attack on McEliece practical?

There's a new e-print out on arXiv titled "A Polynomial Time Attack against Algebraic Geometry Code Based Public Key Cryptosystems" by Alain Couvreur, Irene Márquez-Corbella and Ruud Pellikaan: "We ...
11
votes
0answers
258 views

Is there a pen-and-paper way to securely share a secret via public key encryption? [duplicate]

We have several questions tagged pen-and-paper talking about encryption, hashing, signing, etc. but no question asks about exchanging a secret via public key encryption in a secure way. Does any ...
10
votes
2answers
2k views

Why is this not a viable key exchange algorithm? [duplicate]

I was just wondering why this kind of algorithm can't be used instead of, say, Diffie-Hellman to exchange keys: Alice decides on a key she wishes to share with Bob. Alice generates a stream of bytes ...
10
votes
4answers
5k views

Is it possible to pick your Ed25519 public key?

Is it possible to generate an Ed25519 keypair that has a very similar public key as another keypair (fooling a casual visual comparison) or is this as hard as solving one of SHA-512 or the discrete ...
10
votes
3answers
726 views

Can one have an authentic, but repudiable, message without a previously shared secret?

Bob wants to send a message to Alice, such that Alice can be sure that the message came from Bob, but can't prove it to anyone else. If I understand right, this means that the same message could have ...
10
votes
2answers
2k views

How do malware rely safely on ECDH algorithm to maintain secrecy of keys?

In traditional malware (especially ransomware) using RSA approach, the public key may be hard-coded in the malware binary and is used to encrypt a symmetric key generated on the system. The symmetric ...
10
votes
2answers
636 views

Modular Inverse as a Problem

Given a modulus $N$ and a number $a$, a multiplicative inverse exists for $a$ if $a$ and $N$ are coprime. Why isn’t there a cryptosystem that uses this as a computational problem? Example Alice and ...
10
votes
4answers
4k views

Why should the RSA private exponent have the same size as the modulus?

Consider the generation of an RSA key pair with a given modulus size $n$ and a known, small public exponent $e$ (typically $e = 3$ or $e = 65537$). A common method is to generate two random primes ...
10
votes
3answers
4k views

Is RSA in a ECB-like-mode safe for bulk encryption?

Let's say I would like to communicate with my friend using asymmetric/public-key encryption, e.g. RSA. (Note: I do realize that in practice this is done through an intermediate symmetric key, but ...
10
votes
1answer
6k views

Why does the PKCS1 RSA private key structure contain more than just exponent and modulus?

The ASN.1 spec for the PKCS1 RSA private key format is as follows: ...
10
votes
4answers
14k views

Why is RSA encryption significantly faster than decryption?

I am designing an implementation of RSA . I recorded computation times in Java by using System.currentTimeMillis(). It returned an encryption time of 0.05 ms and ...
10
votes
1answer
705 views

Hash-based asymmetrical encryption (not digital signature) schemes?

In the Wikipedia article or another article about post-quantum crypto there's a plenty of information about hash-based signatures. But where are hash-based ecryption with pubkey? But, over the long-...
10
votes
4answers
506 views

Is there a public key encryption scheme with optimal key size?

Symmetric encryption schemes such as AES have known security levels equal to their key sizes (i.e. breaking an encryption with an $n$ bit key needs about $2^n$ work steps). Elliptic curve encryption ...
10
votes
1answer
406 views

Could this “symmetric RSA” scheme provide key compromise resistant communications?

This question, and fkraiem's answer to it, made me wonder about the security and practicality of using "symmetric RSA" to provide a partially compromise-resistant secure channel. Specifically, assume ...
9
votes
5answers
16k views

Why do we need asymmetric algorithms for key exchange?

In SSL protocols, both symmetric and asymmetric algorithms are used. Why is it so? The symmetric algorithms are more secure and easier to implement. Why are asymmetric algorithms usually preferred in ...
9
votes
3answers
21k views

Why are RSA ciphertexts different for the same plaintext?

I am using SpongyCastle for a project on android. I have used RSA to encrypt the data and then decrypt it in another activity, the keys are stored in the shared preferences. I discovered a thing I ...
9
votes
1answer
6k views

Generating Random Primes

Although this has been extensively discussed around here, I'm curious whether my approach makes sense, or I should just stick to "the standard version". I'm implementing some homomorphic encryption ...
9
votes
4answers
9k views

How are timestamps verified?

You put an input and the hash value comes as an output then when someone puts the input the hash function it is applied to see if it is the same hash original value is stored in some database , that ...
9
votes
1answer
3k views

WhatsApp end-to-end encryption

WhatsApp offers end-to-end encryption. However, when I start using it on a second device such as a PC running Windows, I can decrypt incoming messages without providing any private key into my second ...
9
votes
2answers
2k views

Random Coin Flip using ElGamal and a Trusted Party

An old exam question I am trying to figure out: Consider the following protocol for two parties to flip a fair coin. Trusted party T publishes her public key pk A chooses a random bit $...
9
votes
3answers
10k views

Why can't Diffie-Hellman be used for signing?

I understand that signing is often a case of hashing data and then encrypting the hash with the private key. What properties keep Diffie-Hellman from being useful for this?
9
votes
1answer
7k views

How do other, non-RSA algorithms, compare to the PKCS #1 standard?

Arguably the PKCS suite of standards have a profit-oriented bias as they are promoted by RSA and promote their algorithms over others in the form of RFCs and other means. I'm considering the ...
9
votes
3answers
1k views

Is there an algorithm to find the number of intersections of two sets?

Suppose both I and my friend have a set of integer numbers. We want to know the number of common elements in our two sets but without knowing elements of the sets of each other. So I don't want my ...
9
votes
1answer
2k views

How should I check the received ephemeral Diffie-Hellman public keys?

In my application I'm doing a DH key exchange, where both sides generate their own ephemeral key. No static keys are used. I am trying to make my application resistant against an active attack and ...
9
votes
1answer
4k views

How can I determine the GPG/PGP key ID from the RSA modulus?

According to http://www.pgp.net/pgpnet/pgp-faq/pgp-faq-keys.html#key-public-key-forgery, key ID is some lower bits sequence from the modulus (i.e. the $n$ variable): A PGP key ID is just the bottom ...
9
votes
1answer
397 views

Signature to prove of ownership of arbitrary sized data

I am familiar with public key signatures, but I was wondering if there is a method to accomplish the following. Suppose I publish a file (say a PDF article) on a peer to peer network. How can I ...
9
votes
1answer
562 views

Is there a signature scheme in which private keys can't be linked to their signatures?

Normally in a signature system, the private key can be used to derive the public key, and therefore verify any given signature signed by that private key. Can we create a system without this property? ...
9
votes
1answer
2k views

Simple digital signature example that one could compute without a computer?

I am working on a document to explain Bitcoin to students. But I am having a hard time translating the principle described in §2 of the Bitcoin whitepaper in layman's terms. There is a great question ...
9
votes
2answers
363 views

Why develop Edward curve formulas that deviate from unification?

Edward curves were considered initially because they provide a unified formula for both doubling and addition, thus having inherent side-channel resistance. But a lot of work has been done recently ...
8
votes
3answers
2k views

How can one sign with NTRU?

I am looking at implementing NTRU, but I noticed that while the encryption/decryption algorithm seems to be mature and well-documented, there is comparatively little information about how to sign ...
8
votes
2answers
3k views

Can RSA encryption produce collisions?

In RSA, a message is encrypted by $m^e \pmod N$. $N$ is the modulus, $m$ is the message and $e$ is the public exponent. (I know that $m$ should not be greater than $N$.) My question is, can $m^e$ be ...
8
votes
1answer
2k views

How to prove security of a randomized encryption algorithm?

I have designed an random encryption in public key setting. I am convinced about its security guarantee but I need a formal way to prove its robustness. How can I prove the security of this random-...

1 2
3
4 5
37