Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs

Questions tagged [rsa]

An asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption with proper paddings.

Filter by
Sorted by
Tagged with
0 votes
0 answers
50 views

In RSA, can having a part of e allow for solving it? [closed]

I encountered this problem,the core is as follows.I have n and c,but I only have part of e,The 200 bits of e are zeroed out. ...
Ink's user avatar
  • 1
0 votes
0 answers
56 views

rsa special private key attack

This is a level 3 challenge in Mystery Twister. https://mysterytwister.org/media/challenges/add/mtc3-kitrub-04-speciald-paramter.txt https://mysterytwister.org/media/challenges/pdf/mtc3-kitrub-04-...
Leo's user avatar
  • 1
-1 votes
1 answer
95 views

RSA small private key attack: the private key is slightly larger than the bound given by Boneh and Durfee

$N$ = ...
Lee's user avatar
  • 1
1 vote
1 answer
76 views

Shannon's Perfect Security for Asymmetric Encryption

I have the following definition of Shannon's Perfect Security. Assuming messages and keys are drawn randomly from some distribution then: The probability of guessing plaintext m is not enhanced by ...
revision's user avatar
6 votes
3 answers
4k views

Why does it take longer to generate suitably large primes for Diffie-Hellman key exchange as opposed to for RSA encryption / decryption?

For RSA, we need two primes p and q to define N = pq. We will only look how long it takes to generate a prime for p because the process is similar for q. From my lecture slides, my professor states ...
nasiedlak's user avatar
1 vote
1 answer
28 views

What is the best possible security for authentication of entity?

The classical security for authentication is computational provided by RSA or EC based signatures. With the advent of new PQ schemes the security claims are upgraded though nothing is proved. So the ...
Viren Sule's user avatar
1 vote
1 answer
71 views

Why doesn't the existence of the Quadratic Sieve algorithm imply that integer factorization is in the class SUBEXP?

SUBEXP is defined as the intersection of DTIME(2^n^c) over all c>0. The order of the Quadratic Sieve algorithm is O(exp((k+o(1))(logN)^1/2(loglogN)^1/2)). Doesn't this imply that the decision ...
Omeglac's user avatar
  • 13
0 votes
0 answers
49 views

Reaching the bound of Boneh and Durfee Attack

According to the paper, theoretically,we can get $\delta=0.292 \lt 1-\frac{1}{\sqrt{2}}$,but how to set the lattice and implement it in sagemath? I generated some data by ...
Cred Mao's user avatar
0 votes
0 answers
61 views

Difficulty of factoring large semiprime N if given a second value y = (p-1)*r, where r is a random large prime?

Lets say we have 2 public values: N and y $$ N = pq $$ $$ y = r(p-1) $$ Where p, q, and r are large primes, are different, have a large distance between them and are kept secret. I have three ...
block103's user avatar
2 votes
1 answer
122 views

Confused about use of Euler totient function in RSA

I'm reading a book and I arrived at the part that explains 'textbook' RSA. It explains that given a modulus $n=pq$ and public exponent $e$ that we can encrypt $x \in \mathbb{Z}^{*}_n$ by setting $y=x^...
Mr. B's user avatar
  • 129
0 votes
0 answers
32 views

Sending public key trough untrusted server

I am developing end-to-end encrypted chat system (which is open-source). When I want to give other client my public key, I need to send it trough server, right? I want to make sure no one can edit the ...
ENGO_150's user avatar
3 votes
3 answers
615 views

Why is 65537 always coprime to φ(N) in RSA?

Implementation of the RSA cryptosystem often uses the number $65537$ as a public exponent. It is a requirement that such numbers have an inverse modulo $\varphi(N)$, where $N$ is usually a product of ...
user1145880's user avatar
1 vote
0 answers
115 views

Random padding of RSA-signed message at end instead of beginning of the message

I’ve a signature scheme for 1024‒bit RSA with a 65537 exponent. The signed message is constructed as follows: 760‒Bits fully_user_controlled_message_content+8 Bits incremental nonce+sha256(...
user2284570's user avatar
1 vote
0 answers
67 views

Break RSA knowing N, e, dp+dq

In a cryptography exercise, I have to factor $N$ only knowing $e$ and $d_p+d_q$ (not $d_p$ and $d_q$ separately). I came up with the following equations: $$e*(d_p+d_q) = 2+K_p(p-1)+K_q(q-1)$$ $$e*d_p \...
yusufm's user avatar
  • 11
0 votes
0 answers
104 views

RSA decrypt using Openssl error : Public Key operation error

Hello im got stuck at ctf crypto challenge, so at the challenge is given 3 file which is flag.enc pub.key priv.key , so i tried to decrypt using openssl here is ...
iykyk's user avatar
  • 1
0 votes
1 answer
63 views

Public proven methods to generate SSH key from pass phrase?

Do we have something proven APPS for generate ssh key from some words? I mean private key(without reason wich type rsa or eleptic curves) generated deterministic from seed I found this fork of ssh-...
Andrew's user avatar
  • 1
2 votes
3 answers
162 views

How often do hard-to-factor numbers occur?

[Computer scientist here who is not totally familiar with the factoring literature -- please forgive my ignorance.] It's well known that hard-to-factor integers, $n$, are typically semi-primes, such ...
Hans Schmuber's user avatar
0 votes
1 answer
76 views

Deriving the RSA private key [duplicate]

Is there any way to derive the RSA private key from another RSA private key? Let's say I have a base RSA key $(P, Q)$ (both prime), and then use some salt and an algorithm that creates a new primes, e....
simonS's user avatar
  • 3
4 votes
1 answer
322 views

How can I understand the gap between CPA and CCA1?

I have read lots of books about CPA,CCA1,CCA2. I understand how to get an example satisfies CPA but not CCA2. However, I can't find such a scheme which is CPA but not CCA1. What is the extra advantage ...
Wang Xingwang's user avatar
0 votes
0 answers
52 views

What is insecure about adding salt to your plaintext before using RSA? [duplicate]

RSA can't be used securely as is as it is deterministic. So an encrypted "yes" always looks the same. A simple workaround, which is apparently not secure, is to add 100 bits, say, of random ...
Simd's user avatar
  • 299
2 votes
2 answers
1k views

How do RSA implementations avoid cases where the ciphertext and N are not coprime?

I'm trying to better understand RSA. One attack I've read about is when the encrypted message $y$ and $N = p\cdot q$ share a common factor. If this happens, we can easily factor $N$ to obtain $p$ and $...
rookie's user avatar
  • 123
1 vote
2 answers
409 views

sign a JWT with RS256 using a RSA-PSS SHA256 key pair?

Given a private key using algorithm RSA-PSS with SHA256 is it possible to use this key to sign a JWT using algorith RS256 (RSA with SHA256) instead of PS256 (RSA-PSS with SHA256)? The German ...
Basti's user avatar
  • 113
0 votes
1 answer
215 views

Prove RSA scheme is insecure [closed]

Im reviewing my crypto and I would like to prove the following: RSA experiment where the adversary is given N, e, and y. The adversary knows p, q. I know the RSA scheme is built on the idea that it is ...
Ahmed Zaidan's user avatar
2 votes
1 answer
202 views

Can we use several times the same RSA and ECC keys?

For RSA or elliptic cryptography, can we use the same public/private keys for several exchanges, or is that unsafe? Does it lower the security of the protocol? To me it doesn't matter, as receiving ...
Wheatley's user avatar
  • 147
0 votes
1 answer
114 views

Clarifying terms for cipher, algorithm, rsa, asymmetric, openssl

I am a self taught front-end developer and I am just trying to get my cryptography terminologies straight. I will make some statements. Can someone correct my mistakes? Question 1 I read that cipher ...
learningtech's user avatar
2 votes
1 answer
550 views

How could a 1024‒bits RSA modulus be most economically factored within months today?

Of course this is a question with an answer that is due to evolve. A 2002 paper about TWIRL stated that the cost would be around 10M\$ and an other 10M\$ to manufacture the device. A later 2007 paper ...
user2284570's user avatar
3 votes
2 answers
122 views

RSA given 30% MSB of p and 30%MSB of q

is factoring RSA given 30% MSB of p and 30%MSB of q possible in polynomial time? Notice that it is known that given 50% MSB of p or q it is doable in polynomial time using Coppersmith's theorem
Don Freecs's user avatar
0 votes
2 answers
155 views

Is it possible to perform reverse rsa encryption ? (using the public key for decrypting and the private key for encrypting)

Simple question, but I couldn’t find an answer as I know about signing but don’t want it. The aim would be to encrypt someone’s bet parameter as a short message using the private key and use the ...
user2284570's user avatar
0 votes
1 answer
114 views

What exactly is RSA_WITH_AES256_CBC_SHA256?

Quick disclaimer, I am pretty new to cryptography. I only understand the basics of asymmetric and symmetric encryption. In particular, RSA and AES. I have a project where my service is receiving an ...
Aurelian Milleram's user avatar
3 votes
1 answer
257 views

Implications of switching RSA padding schemes

In my company we want to switch from PKCSv1.5 to PSS for RSA signing. This is because of the marvin attack vector. My question is, if an adversary can see many similar messages that were signed with ...
whomaniac's user avatar
  • 133
6 votes
1 answer
369 views

RSA with 3e≡1 (mod p−1) and 5e≡1 (mod q−1)

Consider RSA with $p$ and $q$ large distinct secret safe primes in interval $\bigl(2^{(n-1)/2},\,2^{n/2}\bigr)$, and private key $(N,e,d,p,q,d_p,d_q,q_\text{inv})$ computed as $$\begin{align} N&=p\...
fgrieu's user avatar
  • 142k
1 vote
0 answers
122 views

Different public keys $(e_i,N_i)$ but same decryption exponent $d$

We are given a number of distinct RSA public keys $(e_i,N_i)$ sharing the same unknown decryption exponent $d$. The $e_i$ were computed from $d$ drawn first, so we have different public keys. Can we ...
Pyp's user avatar
  • 11
1 vote
1 answer
206 views

Could FIPS 186-5 A.1.6 method generate P and Q with different bit size?

refers to FIPS 186-5 document, I have a question about RSA Key generation A.1.6 method, "Generation of Probable Primes with Conditions Based on Auxiliary", my understanding is that, this ...
gx16's user avatar
  • 45
0 votes
2 answers
125 views

What efficiency can we expect from an average consumer computer for the RSA algorithm?

I am trying to implement the RSA algorithm using the C language, for learning purpose. I was wondering how much time should we expect it to take for encrypting a message of size 1024/2048/4096bits on ...
Wheatley's user avatar
  • 147
1 vote
1 answer
85 views

How does the security of RSA compare to a symmetric cipher when both public and private keys are secret?

When RSA is used in a fashion where both the private key and the public key are both secret (for example, when the public key in a KEM is never leaked) could RSA be then evaluated as a symmetric ...
Jackie Lanhorn's user avatar
0 votes
0 answers
90 views

ROCA with unknown M and g [duplicate]

Trying to upsolve "notsosmart - hxp CTF 2017" https://2017.ctf.link/internal/challenge/5c8119ca-bfed-444a-968d-1cc9bff27bfb.html This server code was given during the CTF, letting you get ...
akonzu's user avatar
  • 59
1 vote
0 answers
99 views

Number of elements in cyclic group that satisfy an exponent

I'm having trouble with solving the following question: Given two distinct prime numbers $p, q$ where $(p-1)$ and $(q-1)$ are not divisible by $3$, define $n=pq$. For how many elements in $\mathbb Z^*...
Eatay Mizrachi's user avatar
6 votes
2 answers
357 views

RSA signatures without padding by using XOF output in range [1, n-1]

RSA signatures are implemented by encrypting the padded hash with the private key. Why not take the approach RSA-KEM is using by removing the padding entirely and replacing the hash with a XOF that ...
Jackie Lanhorn's user avatar
0 votes
0 answers
30 views

The Second Attack on Prime Power RSA using Two Decryption Exponents?

in this paper https://eprint.iacr.org/2015/399.pdf how to make the lattice?
happySu's user avatar
4 votes
1 answer
99 views

Is Bypassing Padding Verification in RSA-PSS Dangerous?

I am currently working on a project involving RSA-PSS (Probabilistic Signature Scheme) for digital signatures. While researching potential vulnerabilities, I came across the well-known Bleichenbacher ...
user113612's user avatar
1 vote
1 answer
287 views

Differences between two RSA signatures using OpenSSL

I want to sign a file called data.txt and store its signature in data.txt.sig. To create the signature, I want to use an ...
Allgaeuer's user avatar
  • 123
1 vote
1 answer
114 views

Proving that $\operatorname{parity}(c) = \operatorname{loc}(c \cdot \operatorname{Enc}(2^{-1}))$

I am studying the Goldwasser, Micali, Tong theorem about information leakage in RSA. In every book I have searched, there is the following remark $(c = \operatorname{Enc}(x))$: Note that $\...
Giorgos Mitropoulos's user avatar
2 votes
0 answers
61 views

Cryptographic accumulator via function composition

I am looking for an alternative to RSA accumulators, and I am wondering if the following option based on function composition might fit the bill. It seems like an obvious tweak on RSA accumulators, ...
Carson Farmer's user avatar
-2 votes
3 answers
165 views

Can a very efficient RSA factoring algorithm be worth money?

If someone had a very efficient RSA factoring algorithm, would a company or government entity be willing to purchase it? What factoring time would be considered fast, months, days, hours, minutes? ...
steveK's user avatar
  • 11
0 votes
1 answer
31 views

Threshold signature scheme for centralized group broadcast

I am looking for a threshold signature scheme (or similar proposals are happily accepted) that suits the following scenario: One Base Station is transmitting signed broadcast message to all members in ...
Tom's user avatar
  • 101
8 votes
1 answer
3k views

Are RSA signatures distinguishable from random data?

In the spirit of Are curve secp256k1 ECDSA signatures distinguishable from random data? Are RSA signatures distinguishable from random data? What if you don't know the message? What if you have many ...
Mark Omo's user avatar
  • 189
0 votes
1 answer
199 views

Encrypting large files using RSA and AES-256-CBC-HMAC-SHA256

I developed an application that stores large files. Those files are stored in plain text. Now the project owner wants those files be encrypted on storage, he wants confidentiality, integrity, and ...
Jesús López's user avatar
0 votes
1 answer
114 views

Is there a benefit in cryptography to return 0 in square and mutliply algorithm when a modulo is 0?

When a modulo is 0, the result of squaring or multiplying modulo will always be 0 as well. Therefore the loop could break and return 0. It can be a mean to compute faster the result of square and ...
Christophe Brun's user avatar
0 votes
1 answer
97 views

Looking for a modifiable signature!

I am a graduate student and have encountered some problems in my research. When I generate a signature on the data block of the file, and the signature is composed of the user's private key, the data ...
nan gan's user avatar
0 votes
1 answer
51 views

Compute a proof for a verifiable delay function

I am trying to solve the following problem: Alice generates a RSA key $(n, \phi)$, she shares with Bob the value $n$, and $y = g^{2^{t}}\;\text{mod}\; n$ for $g$ a generator of the group $\left(\...
Kroki's user avatar
  • 111

1
2 3 4 5
56