Questions tagged [public-key]
An asymmetric cipher is an encryption scheme using a pair of keys, one to encrypt and a second to decrypt a message. This way the encrypting key need not be kept secret to ensure a private communication. Similarly in public key authentication, the verification key can be public and the signing key private.
1,849
questions
7
votes
1answer
302 views
Are there groups where the computational Diffie Hellman problem is easy but the discrete log problem is hard?
I know that there are elliptic curve groups, used in pairing-based cryptography, where the decisional Diffie Hellman problem (ie. given $g$, $g^a$, $g^b$ and $c$, determine if $c = g^{ab}$ is easy but ...
7
votes
1answer
554 views
In a lattice, how can one define a good basis and a bad basis?
When it comes to lattice based cryptographic systems, all the literature talks about, good bases and bad bases.
How does one define what a good basis is and what a bad basis is?
7
votes
2answers
1k views
RSA: revealing the modulus factorization by choosing a bad message
I started reading the book Cryptanalysis of RSA and its variants by M. Jason Hinek and I stumbled upon a phrase that intrigued me:
plaintext
messages that are relatively prime to the modulus (i.e....
7
votes
1answer
3k views
Is a private RSA key vulnerable to a chosen plaintext encrypted with that private key?
I grasp that having known plaintext encrypted with the public key doesn't provide a means of discovering the private key (that being the whole point...).
But if one were in a situation where they ...
7
votes
1answer
142 views
Can I switch out a private RSA Key, so that when decrypting a message, it is decrypted to a different message?
Here's a task I've been struggling with:
Say I have an encrypted message $c$, and a desired plaintext $m$. How can I define a valid private RSA Key $(d,N)$, so that $c^d \bmod N = m$
Note that the ...
7
votes
1answer
692 views
Single Ciphertext which can decrypt with multiple keys
Say we have a public key system where we have 2 users, Alice, and Bob each has a public and private key. We also have a publicly available server which stores a message.
I want to encrypt this ...
6
votes
4answers
1k views
Using public key cryptography with multiple recipients
I have a message that I want to send to multiple recipients.
Can I encrypt the message separately with each of the recipient's public keys, then send the message thus encrypted to the respective ...
6
votes
3answers
6k views
How do public key rings work in cryptographic applications?
I am wondering if there are any links to articles or resources available online, or explanations that you can give, that would help me to understand the concept of a public key ring, and why I might (...
6
votes
2answers
2k views
Raw curve25519 public key points
I'm trying to understand curve25519, and ECC public points.
I'm playing with Minisign, to better understand the fundamentals of ECC.
Minisign uses curve25519 and outputs public keys as base64 ...
6
votes
2answers
237 views
What kind of attack could one perform if you generate private keys using SHA3(master_key || nonce)?
I'm aware HMAC is more appropriate than SHA3(master_key || nonce), but I do not understand what kind of attack could be performed against that strategy. How could ...
6
votes
6answers
2k views
Is there an authenticated encryption scheme where the recipient can attribute the message to a single sender?
With a standard authenticated encryption scheme (or MAC), Alice and Bob share a symmetric key. When Alice sends something to Bob, Bob can check that it is authentic. At that point, Bob can deduce ...
6
votes
3answers
407 views
What other one-way functions are used in cryptosystems?
For RSA and El Gamal (and most other public key cryptosystems), one of the key ideas is that factoring and finding discrete logarithms are hard. There are other systems that rely on certain properties ...
6
votes
2answers
585 views
Does Cramer-Shoup allow re-randomization?
Is it possible to re-randomize a ciphertext with the Cramer-Shoup System? I have some Cramer-Shoup ciphertexts and i want to re-randomize them, so they look different and are unlinkable to there ...
6
votes
2answers
564 views
Randomness re-use in LWE encryption scheme
Let me describe the scheme first, it is the scheme proposed by O. Regev when he introduced the LWE assumption.
$sk = \textbf{s} \in \mathbf{Z}_q^n$
$pk = \textbf{A}\textbf{s}+\textbf{e}$ where $\...
6
votes
1answer
1k views
How is the session key more secure than the public key?
From the website of GNU Privacy Guard (GnuPG):
If an attacker could decrypt a session key it would only be useful for reading the one message encrypted with that session key. The attacker would have ...
6
votes
2answers
480 views
Do standalone Oblivious Transfer (OT) Protocols exist?
Are there any Oblivious Transfer (OT) protocols that don’t rely on asymmetrical encryption, public-key encryption or key-exchange?
I’m starting to wonder, as all the OT protocols I know of (and can ...
6
votes
2answers
3k views
Difficulty of breaking RSA for a given key size
Is it true that breaking a 1024-bit RSA key is as difficult as breaking a 128 bit symmetric key (e.g. AES)? I know that breaking a RSA key is equivalent to factoring the modulus $N$. To factor it, you ...
6
votes
1answer
10k views
6
votes
3answers
720 views
The utility of elliptic curve cryptography
Suppose that the only public key cryptography schemes that we knew were Diffie Hellman, RSA and ElGamal. How much would this set civilization back? Are there important applications of elliptic curve ...
6
votes
1answer
5k views
In RSA encryption, does the value of e need to be random?
I am a novice programmer and am just finishing up an RSA encryption program that I am writing for practice. Currently I have the program generate a relatively small random value for the public key e. ...
6
votes
1answer
889 views
Ed25519 PKCS8 private key example from IETF draft seems malformed
Malformed PKCS8 Key
Algorithm Identifiers for Ed25519, Ed448, X25519 and X448 for use in the Internet X.509 Public Key Infrastructure § 10.3. Examples of Ed25519 Private Key states the following:
<...
6
votes
2answers
1k views
Elliptic curve and “vanity” public keys
I want to find an algorithm to get a private/public key pair where one coordinate of the public key has some specific prefix (for example: 20 leading zeroes).
In the secp256k1 case (the Bitcoin curve),...
6
votes
1answer
5k views
Why are key lengths in asymmetric algorithms typically longer than key lengths in symmetric algorithms?
Apologies if this is a duplicate question. I did search prior to posting :-) I think it may be somewhat related to my other question here but I think it's different enough to warrant a separate ...
6
votes
2answers
5k views
What exactly is inside a private key?
May sound stupid to many, but I would like to have some pointers on what exactly is contained inside a private key. I have decent understanding of public/private keys/certificates (have created them ...
6
votes
2answers
3k views
Derive a secret from an RSA private key
What I want to do is deterministically derive a secure key from an RSA private key, such that the RSA private key cannot be derived from the secure key.
The first approach that came to mind was ...
6
votes
2answers
214 views
Is there a theorem to determine the elliptic curve parameters based on the group order?
By Hasse's theorem we know that range of the group order of the elliptic curve. And similarly, there exist a theorem on the admissible order of elliptic curves. Suppose by the theorem on the ...
6
votes
2answers
8k views
How to measure ECC key size?
I have implemented a ECC key generation scheme successfully. Now I need to find ECC key sizes of each generating key pairs. I assumed that ECC key size is the size of the ECC private Key.
So I would ...
6
votes
3answers
247 views
Polynomials and efficient computability
In public key crypto, the popular definitions of security (CPA, CCA1,2) depend on PPT adversaries. I'm trying to understand why adversaries should be PPT.
It's clear that adversaries should be at ...
6
votes
1answer
685 views
Advantages of RSA / EC against QC attacks
We know that both the RSA and ECC algorithms are vulnerable against attacks using (future) Quantum Computing (QC). Are there however any advantages of choosing one algorithm over the other?
As an ...
6
votes
1answer
1k views
Modular exponentiation on calculator for textbook RSA
How do you encrypt $51$ with public key $(n,e) = (91,23)$
I understand that $c = 51^{23} \bmod 91$. How can I calculate the result on a calculator?
6
votes
2answers
5k views
How to generate a public key from a private ECDSA key?
Having some specific ECDSA curve and a private key, how does one calculate the public key? I am having a hard time finding the algorithm and equations for it.
6
votes
2answers
513 views
Why does Encrypt-Then-Sign not yield a CCA-secure public-key encryption scheme?
In symmetric cryptography, combining an IND-CPA secure symmetric encryption scheme with a secure MAC with the encrypt-then-MAC method yields a IND-CCA secure symmetric encryption scheme.
I am trying ...
6
votes
1answer
1k views
Authentication by hardcoding public key in client software
It would seem to me that mobile applications could reduce network traffic by hardcoding the server's public key into the app.
The idea being that they could then encipher a secret to share with the ...
6
votes
2answers
335 views
The difficulty of computing discrete logs
I understand that in Diffie-Hellman it should be hard to compute $a$ given $g$ and $g^a$.
In computational Diffie-Hellman, it appears to be hard to compute $(g^{ab})$ from $g^a$ and $g^b$.
As for ...
6
votes
3answers
3k views
How can I prevent a message replay with RSA?
I am using RSA to encrypt some data but I would like to eliminate the possibility of message replay. By message replay I mean sending a valid message multiple times to the original recipient. It is ...
6
votes
2answers
417 views
Finding the subgroup in isogeny-based cryptography
Isogeny-based cryptography is one of the newest post-quantum cryptography. Hardness of this system is based on finding isogeny between two elliptic curves. Also this is theorem:
Elliptic curves are ...
6
votes
2answers
673 views
Can an RSA public key be generated without ever knowing the factors? [duplicate]
Context: http://blog.cryptographyengineering.com/2013/12/a-few-more-notes-on-nsa-random-number.html
Assume I wanted to use RSA as the basis for a hash function or DRBG. Also assume that my construct ...
6
votes
1answer
1k views
Question about why RSA is hard to attack
I think I understand why RSA is hard to attack but I'd like to get clarification if I actually do.
Assume there are two people, Alice and Bob, who are attempting to communicate privately but that we ...
6
votes
1answer
397 views
How are trapdoor functions developed/found and where can I find existing ones?
Trapdoor functions are a fundamental part of public key cryptography. An example of the most common trapdoor is
Prime Factorization, used in cryptosystems such as RSA
How are these trapdoor ...
6
votes
1answer
10k views
How exactly does certificate based authentication work?
I know the concept of key generation, as well as encryption and decryption using public and private keys.
When it comes to authenticating a user by a server, in general there are three types:
...
6
votes
1answer
603 views
What is the difference between RCCA and CCA2?
Well, I know it's easy to tell CCA1 from CCA2, but I failed to find the difference between RCCA and CCA2.
What is the difference?
6
votes
1answer
54k views
How to decrypt a '.enc' file that has been encrypted with RSA using a public key? [closed]
While solving a CTF challenge online, I came across a situation where I needed to decrypt a '.enc' file that has been encrypted using someone's public key. The ...
6
votes
1answer
2k views
Public-Key Deterministic Encryption : Why does not provide perfect security?
I've got a question about an assignment . The question is "Why a Public-Key Deterministic Encryption Algorithm does not provide perfect security ?" . I suppose it means according to Shannon .
Any ...
6
votes
1answer
1k views
Proof that padded RSA is CPA-secure
I'm referring to page 383 of J. Katz and Y. Lindell's Introduction to Modern Cryptography. The book presents a padded RSA:
${\bf Key Generation:}$ same as Textbook RSA (given security parameter $1^...
6
votes
1answer
2k views
Client and server using same SSL certificate - any issues?
I'm working on software where multiple components will communicate with each other using SSL.
There would be one central component acting as a server, which would also require the clients to present ...
6
votes
1answer
4k views
Get RSA PlainText without Knowing Private Key
If I have an algorithm,RSA-Crack(), that, for a given RSA public key (n,e), is able to decrypt 1% of the messages encrypted with that key (without knowledge of the corresponding private key).Can there ...
6
votes
3answers
768 views
Has any alternative to RSA and Discrete Logarithm been standardized for deployment?
Suppose RSA and Discrete Logarithm over any group (including elliptic curves) gets broken what other schemes we have for DEPLOYMENT IMMEDIATELY do we have to rescue the internet from collapse?
So ...
6
votes
2answers
167 views
Layered encryption in mixnets with post-quantum cryptography
I am trying to implement a mixnet using post-quantum public-key crypto. Each message may be encrypted by up to 10 levels of public keys, shuffled, before the layers of encryption are stripped off one ...
6
votes
1answer
1k views
Key Exchange & key Distribution in symmetric key cryptography
I want to know whether there is a difference between key exchange & key distribution in private key cryptography as well as public key cryptography?
or is it the same term?
6
votes
1answer
1k views
Can an U2F public/private key-pair for signatures be used for encryption?
I understand that this might be more a process question:
Given a U2F device which supports signatures using ECDSA public/private key pairs, is there a way to use the signing function of such a device ...
