Questions tagged [rsa]

An asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption with proper paddings.

Filter by
Sorted by
Tagged with
1
vote
2answers
39 views

Converting RSA.pub keys to word list

RSA keys are notoriously blobs. I'm looking to make something more human readable. I want to take the mathematical operation and convert it to a number that can be easily expressed as a series of ...
2
votes
2answers
89 views

When is a cryptosystem or its algorithm (like RSA) considered efficient?

When is a cryptosystem (like RSA) or its algorithm for keygeneration, encryption and decryption of messages considered efficient? Is there some bound in complexity which splits both efficient and not ...
2
votes
0answers
29 views

Multi-users RSA problem

Rivest and Kalisky's RSA problem considers various notions on security of the RSA One-Way Trapdoor Permutation. They do it only from the perspective of a single user. What's the state of the art in ...
2
votes
0answers
72 views

Fixed point in RSA encryption

Some papers count the number of the fixed points in the RSA encryption algorithm. They're a minimum of 9 and the real number depends on the smoothness of primes $p$ and $q$. It very unlikely that a ...
3
votes
1answer
48 views

Computational trapdoor where the problem is tractable for both parties but easier for one

Usually the sort of trapdoors which are talked about are designed such as to make the computation intractable for one party and tractable for the other. But what if one party merely has a big ...
1
vote
0answers
169 views
+50

Proving the knowlege of e-th root in an non-interactive way

Just like in this question: Protocol for proof of knowledge of $l$-th root I want to prove that for $u^e = w$ I know $u$ without revealing it. Three other requirements are: e is small (65537) The ...
2
votes
1answer
109 views

Is it safe to reuse the same random session number r in the Guillou-Quisquarter protocol?

I basically use the method below, one difference is that after receiving the first proof the verifier asks the prover to create a proof for another challenge d and this several times without having ...
1
vote
1answer
37 views

RSA assumption and relationship given by generating elemts of a Cayley graph

I have read a very interesting description of computation related to the RSA group as follows. "By the Chinese remainder theorem, we have that: $$(\mathbb{Z}/pq\mathbb{Z})^* \cong (\mathbb{Z}/p\...
0
votes
0answers
23 views
0
votes
1answer
168 views

Asymmetric Cryptography decryption

I am new to cryptography, i know essential part of asymmetric cryptography but is it possible to decrypt 617 decimal digits (2,048 bits) with RSA ? How it can be factored?
0
votes
0answers
15 views

Generating RSA keys with plain and ciphertext [duplicate]

I have plaintext and ciphertext. Is it possible to generate an RSA key pair that encrypts the plaintext to ciphertext and decrypts ciphertext to plaintext. I don't need to find the original key pair ...
0
votes
1answer
47 views

RSA basic Euler

I asked these questions from a very superficial level, without wanting to get too far into the maths as I lack the experience. p = 47, q = 53. In real life these would be larger. Euler(47*53) = (47-1)...
2
votes
0answers
28 views

Update non-member witness in RSA accumulator

According to study of "Universal Accumulators with Efficient Nonmembership Proofs", I don't understand exactly how to update non-member witness in construction 4.2. In the addition step, I understood ...
2
votes
0answers
52 views

One-Way Trapdoor Permutation more secure than RSA at same width?

The classical One-Way Trapdoor Permutation is RSA. The permutation that it implements on a set of $n$ elements¹ is invertible by an adversary knowing only the public key with work $w$ conjecturally² ...
-1
votes
0answers
30 views

Q Inverse in RSA key pair [duplicate]

I wanted to try RSA CRT hence generated RSA key pair out of OpenSSL, however the generated key pair does not have Q inverse. Do we need to calculate it ? or is there an option in OpenSSL to generate Q ...
0
votes
0answers
56 views

Why modn and modular exponent g^x mod n are not cryptographic hash functions?

I have been trying to find a solution to this question and wasn't able. When it comes to signatures and Hash Functions, how would be possible to show that $\pmod n$ and modular exponent $g^x \pmod n$ ...
1
vote
1answer
37 views

Finding RSA private exponent with a chosen ciphertext attack?

Let's say there's this blackbox app that has a known modulus $N$, private exponent $e$, and takes ciphertext $C$ encrypted against $N$ and $e$ input and outputs plaintext $M$. The encryption is done ...
0
votes
0answers
13 views

Issuer generate credential in CL signature scheme

In the paper CL signature scheme, the authors describe the scheme to generate and verify credentials. I have a question regarding the credential generation from issuer. In page 11, section 4.4, ...
0
votes
1answer
42 views

Application of Non-deterministic Processors in side channel attacks

I was reading the abstract of "Non-deterministic Processors" paper by "David MayHenk L. MullerNigel P. Smart", in the abstract, they have mentioned the Kocher paper about "Timing Attacks on ...
-1
votes
1answer
44 views

Bruteforce attack on a 64bit computer [duplicate]

How would I attempt to brute force a RSA encrypted message with a 64bit computer if it the memory can't put up with calculations bigger than 64bit? Without going that far to attempting to crack it, ...
1
vote
2answers
88 views

RSA: unknown public exponents

Suppose I intercept the same message m sent to 2 friends. I know what the message is and I know the used modulus n, as well as the ciphertexts but I don't know the respective public exponents. I.e. my ...
1
vote
1answer
58 views

With composite $n_1$ = $p_1q_1$, and a separate $n_2 = p_1q_2$, can the primes be calculated more efficiently than factorization?

Supposing that the (3 total) primes are kept secret? Does the reuse of $p_1$ allow an attacker to compromise $n_1$ and $n_2$ if the attacker guesses that both were generated with a shared prime ...
0
votes
1answer
21 views

Does this system for unlinkable contact signals that function to encode symmetric session strings work?

A basic cryptographic accumulator can be implemented by simply multiplying prime numbers to form a composite number such that the membership of any given prime can be determined simply by dividing it ...
0
votes
1answer
40 views

How to prove that RSA is not IND-CCA2?

RSA is homomorphic wrt multiplication and therefore it is not IND-CCA2. But how to show it. What are the steps to win IND-CCA2 game? How is the probability of winning calculated?
0
votes
0answers
55 views

Are My Answers for This RSA Question Correct?

I am very new to cryptography and so I am looking for feedback on this question on RSA. Please let me know if I have made any mistakes, Thank you! (a). RSA Algorithm: -choose two primes p,q -...
0
votes
0answers
25 views

RSA Encryption - What property of RSA keys is causing the output after 5x RSA to be the same as the input? [duplicate]

For example, R (R (R (R (R (m))))) = m where R(m) denotes the RSA encryption with public keys N and e. What property of the RSA keys would cause this?
3
votes
1answer
158 views

Why when I perform RSA 5 times do I get my original input back out?

If I perform RSA on my input 5 times, I get the original input back out. Why is it that often, iterating RSA encryption just a few times cycles yields back the original value, when the public modulus ...
-2
votes
0answers
28 views

How can you decipher a encrypted message, m, given only that it is not coprime to N

is anybody able to help with the following question?
1
vote
0answers
16 views

Could a private key recovery via modulus fault attacks be optimised by being able to choose the faulty moduli?

The paper 'Why One Should Also Secure RSA Public Key Elements' describes an attack where an adversary can fully recover a private key by injecting faults into the modulus before exponentiation takes ...
2
votes
1answer
169 views

RSA and the strong RSA assumptions

The RSA assumption: Given a randomly generated RSA modulus $n$, exponent $r$ and a random $z \in \mathbb{Z}_n^{*}$, find $y$ such that $y^r=z$. The strong RSA assumption: Given a randomly chosen ...
1
vote
1answer
113 views

How to produce large list of BigInteger prime numbers (RSA) in fast and efficient way

Hello fellow experts here, in order to use RSA to encrypt and decrypt in a controlled environment, we will actually need to have a list of prime numbers to do so instead of using library generated RSA ...
1
vote
0answers
19 views

Size of messages in timing attack on RSA Montgomery

I'm codin' timing attack on RSA Montgomery which compares two sets ( the first one includes those which need a reduction in contrary to the second one ). But I got troubles with the Montgomery ...
1
vote
1answer
50 views

How to calculate RSA Key Size correctly starting from 384 bits to 15360 bits or beyond 15360 bits

Hello fellow experts here, I am new to cryptography. Recently I looked into RSA Key Size (Microsoft RSA library), it actually describes that the minimal key length required is 384 bits and maximum ...
0
votes
0answers
31 views

It is possible to apply the Coppersmith method to the polynomial $F (x0) = 0 \bmod M ^ 2$ with $| x0 | > M$?

It is possible to apply the Coppersmith method to the polynomial $F (x0) = 0 \bmod M^2$ with $| x0 | > M$? $F(x0)=0 \bmod M^2$ and find the solution $| x0 | > M$ Example $x^2+4 \times x-...
0
votes
0answers
53 views

Can someone explain the timing attack on RSA with Montgomery multiplication?

I have read several articles on the temporal attack against Montgomery multiplication to speedup RSA computations. However, I do not quite get the principle. I understood that there is a additional ...
3
votes
1answer
215 views

Why does RSA OAEP add this many zero bytes?

The choice of $n_\text{Len}–K_\text{Len}–2\,H_\text{Len}–2$ zero bytes seems arbitrary to me and I can't see any reasoning for why it was chosen and it doesn't look like the zero bytes being replaced ...
1
vote
0answers
61 views

RSA Partial Known Plaintext Encryption? [closed]

I'm facing an RSA CTF problem to solve. All I have is: The public key $(n,e)$, with $e=3$, and $n$ of 1024 bits $C'$, the encryption of a long number $K$, where $C' = K^3 \bmod n$ The Ciphertext ...
3
votes
1answer
124 views

Breaking ciphertext using a quantum computer when the public key is not available

As we know about Shor's algorithm on quantum computers it is possible to crack RSA / ECC easily if we have enough qubits. Is it possible to crack RSA / ECC on a quantum computer if we only have ...
-2
votes
0answers
238 views

RSA factorization . How should I choose a to have a smaller computational complexity?

Given $N=p*q$ Solving these four with odd $x$ and $N$ with $h$ varying from $0$ to $7$ and with $a >= 1$ and $x >= 3$, assigning at $a$ value to our choice such that [1] $[8*(96 k² + 24 k + 1)...
2
votes
2answers
161 views

Why is 0x10001 used as an RSA exponent so often?

Are there any other commonly used exponents? Why are they selected?
2
votes
1answer
83 views

Problem with RSA deciphering

I don't quite get the algorithm yet. Sometimes it works and other times it doesn't,so clearly I am overseeing or misunderstanding something. I will just write what I did. My $N=143$ and has factors ...
1
vote
1answer
75 views

How message digest hash is used in RSA digital certificate verification

This is how I understand digital signature verification to work in general: Plaintext gets run through a hashing mechanism to make a message digest (IBM's terminology, there appear to be plenty of ...
0
votes
0answers
19 views

Finding the relationship between generating elements represented by a Hamiltonian cycle of a Cayley graph (like in strong RSA condition)

Consider an undirected Cayley graph of a finite group $\mathbb{Z}_p \times \mathbb{Z}_q$, where $p$ and $q$ are distinct primes. Let the generating set for the Cayley graph be $S=\{g_p, g_q\}$, where $...
3
votes
1answer
82 views

Does signing multiple messages with the same RSA key weaken the encryption?

Here is the scenario, I am signing roughly 1000 messages, which consist of 16 byte hashes, with 1024 bit RSA. The private key is only used to sign the hashes, and there is no padding scheme. The ...
1
vote
0answers
30 views

is there an effective attack against rsa by knowing the coefficient $u$ of the private key? [duplicate]

consider that an attacker has the public key $(n, e)$, where $n$ is $1024$ bits long, the $32$ largest bits of $p$ (where $n = p \cdot q$), as well as $u = p^{-1} \pmod q$. Is there an attack that ...
1
vote
1answer
82 views

RSA: Know the public key from a pair of plain text and their cipher?

I have two plain texts files cipher with RSA (with the same public and private key) and I have their cipher texts too. Would it be possible know the public key from that information? My messages have ...
0
votes
0answers
28 views

Private Key “Encryption” with raw RSA fails when key length is the same as message length

I wrote another question here, where i wanted to find a (signing) method, that allows for very short ciphers, where the ciphers length is equal to the messages length (no appended signature) and where ...
0
votes
0answers
31 views

When connecting via SSH, does the Diffie-Hellman key exchange take place over an unencrypted TCP session or does encryption occur before the exchange?

I'm a cybersecurity student and I'm eager to understand the basic processes of an SSH session. I wrote down the stages to the best of my ability but need help understanding what happens right after ...
0
votes
1answer
72 views

Attack RSA with very big module ($n$) and very small $e$ (7)

As an exercise I'm given an RSA to attack. I have the module ($n$), the public exponent ($e$) and a single ciphertext ($c$). For this particular case, $n$ is VERY big (5 thousand digits more or less),...
2
votes
1answer
122 views

In RSA encryption, why does the public exponent (usually, 'e') have to be coprime with $\varphi(n)$?

I have seen that there is a similar question here but none that really answers the question. I understand that if I choose the encryption exponent $e$ not coprime with $\varphi(n)$ then there is not a ...

1
2 3 4 5
42