Questions tagged [rsa]

An asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption with proper paddings.

Filter by
Sorted by
Tagged with
0
votes
0answers
5 views

Is Email Signature between Two Users Secure?

My apologizes about not submitting my last question correctly (I will try to make sure it does not happen again). I was wondering if someone could help me with this question. I am under the assumption ...
0
votes
0answers
17 views

How to complete man in the middle with public key? [closed]

I was wondering if someone could help me with this question. I am under the assumption that the email system that bob and Alice are using is secure and Eve cannot gain access to their messages. Would ...
1
vote
1answer
24 views

Verifiable Delay Function: Trusted Setup

Efficient Verifiable Delay Function paper suggested that there is two way to construct the group. One of them requires trusted setup in the sense whoever constructs the RSA unknown group order needs ...
5
votes
1answer
90 views

Zero-Knowledge Proof of Equality between RSA Modulus and Prime Order Group

Assume there is an RSA public key $(e,n)$ such that factarization of $n$ is unknown to both prover and verifier parties. We also have a prime order group $G$ and a generator $g$ for the group. For $m\...
1
vote
1answer
31 views

CrypTool RSA Features [duplicate]

I am attempting to manually encrypt a plaintext message (message = MI) using RSA. I receive an answer of: 33,264 and 21,164. When I enter the same plaintext into CrypTool to confirm that my ...
0
votes
0answers
58 views

Am I Doing RSA Correctly?

I am trying to figure out how to complete RSA manually. I am trying to encode a simple block message (Mi). I used CrypTool to determine the encryption. When I "manually" computed the ...
0
votes
0answers
31 views

Decrypt Ciphertext Using different private key, given knowledge of original private key

A message, m is encrypted using a private key d. ...
0
votes
0answers
28 views

My tutorial question for help [closed]

A lecturer wants to gather votes (either “0”, “1”, or “2”) from the class during lecture. The lecturer has published an RSA public key which is a 2048-bit RSA-modulus n, and the encryption exponent e ...
1
vote
0answers
36 views

Verifiable Delay Function - Fake Proofs

For unknown group order such as RSA groups $ G %$, it takes $T$ sequential steps to compute the below function (time-lock puzzle). $$ y = g^{2^T} mod N$$ This paper states that if $ /Phi(N) $ (Group ...
1
vote
1answer
321 views

Is it alright to generate RSA keys with bit sizes other than 512/1024/2048?

I am keep generating RSA keys for 512/1024/2048/4096... as bit size. Each time the key length is increasing. Is it possible to generate/use keys other than the ...
0
votes
0answers
46 views

How do you solve Textbook RSA? I'm given ct, n, and e [closed]

I'm doing a CTF challenge and I'm trying to solve textbook RSA. Could someone answer this question teaching me how? Thanks Challenge: e = 3 n = ...
0
votes
0answers
18 views

Decrypt encryptedKey session key using - AES-128 - PKCS-1#rsaes-kem-kdf2-kw-aes128

I have basic knowledge about how encryption algorithms work such as RSA, AES and so on. I have an XML response encrypted with both AES and RSA. I tried using OpenSSL to decrypt with several steps but ...
2
votes
2answers
212 views

VDF / RSA groups

I believe I am overthinking it; however, I need to clear out my doubts. What is exactly RSA groups and how their order is unknown? I know in RSA N is computed by multiplying two prime numbers (p and ...
0
votes
1answer
37 views

RSA encryption key conditions

I recently read the RSA cryptosystem but now I confused in key generation phase. According to the Euler's Theorem, we have just one condition: e.d = k.ϕ(N) + 1 where: "e" is encryption ...
31
votes
1answer
5k views

How was this 2048 bit number factored so fast?

I'm working on a CTF. The challenge is to get the contents of an encrypted message given the ciphertext and the 2048-bit RSA public key. I did finally get the flag after a few hours, but I'm still not ...
0
votes
0answers
106 views

Given $e$ and $d$, find $\phi(n)$

Let's say we have just RSA public and private exponents $e$ and $d$ but not the corresponding modulus $n$. Is there a method to find $\phi(n)$? This is for a CTF challenge. I am not concerned about ...
5
votes
1answer
174 views

Security of RSA-3072 with public exponent $2^{16}+1$

NSA recommendation for the pre-quantum period allows the use of RSA-3072 (https://apps.nsa.gov/iaarchive/programs/iad-initiatives/cnsa-suite.cfm), nevertheless, is it safe enough to do it with the ...
1
vote
1answer
43 views

RSA vs diffie-hellman + polyalphabetic cipher

My basic question is: How does RSA compare to using Diffie-Hellman + <some symmetric key crypto, e.g. a polyalphabetic cipher> Let's assume that factoring large numbers and computing discrete ...
1
vote
1answer
110 views

What is the 2021 Padding Recommendation for RSA?

What is the current, year 2021, padding Recommendation for RSA? PCKS1? 7? 11? OAEP?
2
votes
0answers
39 views

Large e in RSA but not Wiener attacks

How to find $d$ with large $e$ ? If $(3\cdot d)^4 \le n$ : Wiener attacks, so what if $(3\cdot d)^4 > n$ ?
0
votes
0answers
31 views

How is hybrid (RSA+DH) more secure than RSA quantitatively?

Is there any graph that serves as a comparative analysis for the factorization problem vs discrete logarithn problem? I am implementing an hybrid encryption algorithm (RSA + Diffie-Hellman) and it is ...
0
votes
1answer
49 views

Is there much difference in a RSA-4096 over RSA-3072 for support/speed and security?

I am in the process of created a signing certificate and i have an option of RSA-4096 or RSA-3072. Is there much difference in security between the two? I know people say RSA-3072 should be good until ...
0
votes
0answers
57 views

Given N and e in RSA and the ability to get signature s for any message m, can you find the value of the private key d?

Given N and e in RSA and the ability to get signature s for any message m ($s=m^d \mod{n}$), can you find the value of the private key d?
0
votes
1answer
59 views

RSA and Wiener's attack [closed]

I'm trying to do Wieners' attack for the case \ ...
1
vote
1answer
62 views

Subtle Crypto Algorithm Choice

I need to encrypt some text in the browser to be stored server side. After a little research I decided to use the SubtleCrypto API. I created the the crypto key using the following code: ...
0
votes
1answer
40 views

detect the RSA public key from encrypted text

we have a service who has a list of public keys got from clients (for example 1000 public keys. not too many) service gets an encrypted message from one of clients. this message is encryped with a ...
0
votes
0answers
48 views

How can I enhance the security level of my RSA code?

I am trying to enhance the security level of my RSA code that I implemented in Python. I tried to add blind operation, randomized algorithm to my RSA code (separately, not together), but I am not sure ...
3
votes
1answer
152 views

How many encryptions are needed before OpenPGP key privacy is violated?

According to an excellent answer describing the pitfalls of key privacy in OpenPGP: Theoretically, an all-zero key ID can be used as a way to discourage traffic analysis, but this is not a complete ...
0
votes
1answer
61 views

Is this protocol secure?

Before anyone freaks out, this is purely speculative and I am not developing a cryptosystem! I can't see anything wrong with this protocol, but my knowledge of cryptography is rather superficial: ...
7
votes
2answers
3k views

Is it proven that breaking RSA is equivalent to factoring as of 2021?

I can't find any publication that proves this.
2
votes
0answers
30 views

RSA plaintext repetition attack, (same plaintext, different ciphertext) [duplicate]

Billy wants to send a message to Bob. He generates secure primes p and q for each time he sends a message. However, he ...
9
votes
1answer
1k views

Does the security of RSA come from just the carries in multiplication?

Although it's hard for me to find a reference, it's my understanding that if you calculate $N = pq$ using $GF(2)$ polynomial multiplication rather than ordinary multiplication, it is easy to factor $N$...
1
vote
2answers
121 views

Why doesn't any cryptographic library apply the Lehman's method?

Lehman's method can be described as; Let $N=pq$. If the ration of $p/q$ is near a ratio of two small numbers $r/s$, then $ps$ and $qr$ are close to $\sqrt{nrs}$. The Fermat's method can be easy ...
2
votes
0answers
65 views

Security of Full Domain Hash (or not quite full)

Full Domain Hash is the simplest signature scheme based on a trapdoor permutation (such as textbook RSA) that enjoys a strict security reduction. It was introduced by Mihir Bellare and Phillip Rogaway:...
0
votes
1answer
44 views

What is the difference between probabilistic and deterministic prime-factor recovery function in NIST 800-56B?

In the previous standard, the deterministic was not included. It is already in the current standard. What is the reason for this? Can I use both function?
2
votes
1answer
84 views

Why is it necessary a prime factor recovery for a RSA Key-Pair Validation (in case of fix public exponens)?

In NIST 800-56B publishing, this is done with the $(p, q) = RecoverPrimeFactors (n, e, d)$ function. I don't understand why is necessary if $p$ and $q$ are known during in generation. In my opinion, ...
0
votes
0answers
24 views

What is the number of fixed plaintexts of RSA [duplicate]

Considering RSA, $n=p\,q$ with $p,q$ odd primes and the public key $(n,e)$, where $\gcd(e,\phi(n))=1$, I need a hint on how to show that the number of plaintexts with $E_e(x)=x$ equals $\gcd(e-1,p-...
5
votes
2answers
255 views

Breaking RSA with Factor in Range of $\sqrt{N}$

Suppose on of the RSA prime factors $p$ is the range of $\sqrt{N}$, in particular it holds that $|p-\sqrt{N}|<\sqrt[4]{N}$ I want to show that RSA can be broken in time poly(log N) Given hint: $N = ...
0
votes
1answer
89 views

How many points in RSA, such that $m^e = m \bmod n$

For every RSA-cryptosystem, there exist some messages $m$, for which it holds that $m^e \equiv m \pmod n$ As to the question, how many such messages exist, this question has already been asked and ...
1
vote
1answer
94 views

RSA public key identification

Consider a multi party system where public keys of all receivers are known. Server wants to send message to one of them using (textbook?) RSA. Adversary is given ciphertext and even Message to be send,...
3
votes
1answer
99 views

Does blinding protect again fault injection attack against RSA with CRT

I know that blinding can be used as a countermeasure against side-channel timing attacks on RSA-CRT: RSA Timing Attack and Prevention through blinding My question is: can blinding also be used as a ...
2
votes
2answers
156 views

How many low-order bits of an RSA modulus can we safely fix to 1?

It's easy to generate an RSA modulus $n=p\,q$ of $k$ bits with $n\equiv-1\pmod{2^\ell}$, for $\ell$ up to about $k/2$: we can choose $p$ as usual, fix the $\ell$ low-order bits of $q$ to $-p^{-1}\...
0
votes
0answers
35 views

Difficult to guess the targeted receiver

The protocol is defined as : Bob want to send message to one of his friends say $k$ friends , he does not want his others friends (except one whom he want to send message ) to tell who is targeted ...
0
votes
0answers
67 views

Why is ((m^e mod n)^d mod n) = (m^ed mod n) in RSA? [duplicate]

$$RsaPrivate(RsaPublic(m)) = (m^e \bmod n)^d \bmod n = (m^e)^d \bmod n$$ $$RsaPublic(RsaPrivate(m)) = (m^d \bmod n)^e \bmod n = (m^e)^d \bmod n$$ why is this always true?
1
vote
2answers
126 views

DHKE Square and Multiply

Given is a DHKE algorithm. The modulus 𝑝 has 1024 bit and 𝛼 is a generator of a subgroup where 𝑜𝑟𝑑(𝛼)≈2160. Assuming the public keys have already been computed, how many number of modular ...
0
votes
0answers
56 views

Can you obtain private key d and compute plaintext from El-Gamal?

Given an Elgamal encryption scheme with public parameters $k_{pub}=(p,\alpha,\beta)$ and an unknown private key $k_{pr}=d$. Due to an erroneous implementation of the random number generator of the ...
7
votes
2answers
2k views

Prime factorization (102 digits)

I have a number that consists of 102 digits and I need to factor it. I ran it in alpertrom.com.ar, but it'll take up to 40 hours if I counted all right. Is there any way to make it by hand (stupid ...
3
votes
1answer
74 views

Commitment schemes for arbitrarily large integers

My question is about commitment schemes for arbitrarily large integers. One scheme I know uses groups of unknown order (RSA or class group) and depends on the strong-RSA assumption. You chose a random ...
2
votes
1answer
80 views

RSA proof regarding m % n

I have a question regarding the proof that RSA works I understand that $m^{(ed \bmod z)} \bmod n = m \bmod n$ , but I don't understand why $m \bmod n = m$ (This question assumes m is the message, $z=(...
1
vote
0answers
48 views

RSA with Carmichael number

I've to prove that RSA still works with a public key $(e,pq)$ where p is a prime and q is a Carmichael number such that $q<p$ and $\gcd(e,(p-1)(q-1))=1$ I know how RSA works wiht $p,q$ primes but ...

1
2 3 4 5
47