Questions tagged [rsa]

An asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption with proper paddings.

Filter by
Sorted by
Tagged with
0
votes
0answers
5 views

In regard to using RSA-OAEP-256 in JWE to also authenticate token issuer

I'm not an expert on cryptography, so, the understanding below might not be entirely correct. From what I understand, in the context of JWE, the RSA-OAEP-256 key algorithm is meant to provide payload ...
1
vote
1answer
47 views

Any way to prove possession of a RSA 2048 private key using 256 bit?

Alice has a RSA 2048 private key and Bob has corresponding public key. They have a secure connection, but Alice can transmit only 256bit to Bob (Bob can transmit any amount of data to Alice). Is there ...
2
votes
1answer
74 views

What is the overhead of GCM? And how are GCM tags signed by RSA/PKI?

I'm mainly trying to wrap my head around the pipeline of encryption, hashing and signing. I've read over this question, describing the overhead of GCM, which I understand to be configurable for space-...
11
votes
2answers
2k views

More than one private key for RSA

In an RSA-encryption scenario, Bob's public key pair $(n, e)$ is $(143, 43)$. An attacker Mallory tries brute-force and comes to $d = 7$ as the private key. The value of $φ(143) = 120$ is not known to ...
1
vote
1answer
39 views

PKCS RSA - Why do we need encoding

In the RSASSA-PKCS-v1_5 signature scheme, the first step is to perform an encoding on the hashed data. (0x00||0x01||PS||0x00||T). Is this encoding important for security ? What happens if the hash is ...
2
votes
2answers
93 views

Actual RSA encryption & decryption of strings?

$K_{pub} = (n, e)$ $K_{pvt} = d$ Then $E_{K_{pub}}(x) \equiv x^e \mod n$ Practically, when RSA is used to encrypt strings, what is the $x$ here? You cannot take it byte by byte because $\mod n$ will ...
2
votes
1answer
72 views

Textbook RSA signature forgery when e=65537

Searching about RSA signature forgery I came across this question. In the answer, it is stated that for small to moderate $e$ (including $e=3$ and $e=2^{16}+1$, often used in practice), it would be ...
0
votes
1answer
58 views

PGP private key format

I have a PGP Private Key from Bob. ...
0
votes
1answer
78 views

Finding p and q in RSA with a given n, |p-q|<10000

I've got an RSA encryption I need to crack, but to do it I need to find the p and q values of an N I am given - it's quite large, around 308 symbols. I know that N is the product of primes p & q, ...
0
votes
1answer
36 views

Suitable hybrid encryption approach?

I need help for my bachelor thesis. I have a general question regarding hybrid encryption in different ransomware. The hybrid encryption often uses symmetric and asymmetric encryption techniques. ...
0
votes
1answer
274 views

Finding MSB in RSA

Scenario: Alice and Bob send each other encrypted AES (128) messages. In order to change key, Alice has a public RSA key (2049 bits). Bob has Alice's public key. Bob picks a random AES key, encrypts ...
0
votes
1answer
67 views

Why does RSA 1024 provide lower security level than EC256? [duplicate]

And why do we have to use big numbers for RSA? Is it because of some RSA restrictions like p=q=3 mod 4?
1
vote
1answer
52 views

Standard tools for deterministic RSA key generation using seed?

I'd like to resuse the mnemonic I have from bip39 for crypto in other domains such as ssh and tls, etc. Are there standard tools (ie, openssl) to deterministically generate rsa key/pairs given a seed ...
6
votes
1answer
366 views

Relation between factors and their sum on RSA

In RSA and other crypto based on prime factors. If I would know the sum of $p+q$, would it reveal any more information than just knowing $p\cdot q$? Edit: I do not know either $p$ or $q$. The question ...
1
vote
3answers
96 views

What's the preferable encryption for large data and files in terms of speed and security other than AES?

First of all, I'm relatively new to encryption so please bear with me. I'm looking for a way to encrypt large amounts of data only on my device, no need to transfer my encrypted files/data (10-20GB or ...
0
votes
1answer
97 views

Is there a problem with this specific RSA protocol?

So a protocol uses two random primes $P$ and $Q$ with the equivalent bit length of around 2048 bits, multiplies to form $N$. The encryption function in detail is: $m^e \bmod\ N$ $(\text{512-bit-random-...
1
vote
1answer
82 views

Research Guidance on Elliptic Curve Cryptography [closed]

I am a freshman who want to research elliptic curve cryptography. There are a few questions I have: Firstly, I am not sure about how I should narrow down the topic. Where should I focus on? Can I ...
1
vote
1answer
68 views

RSA PKCS#1 OAEP Padding Schema - padding 0 for first octet?

In this document, it shows the EM will have one zero octet padding prefixed. ...
3
votes
1answer
41 views

How to attack Oblivious Transfer from a malicious sender that can deviate from the protocol

I am looking at at the $1–2 \space \text{oblivious transfer}$ that is described here: https://en.wikipedia.org/wiki/Oblivious_transfer#:~:text=In%20cryptography%2C%20an%20oblivious%20transfer,Rabin. I ...
1
vote
1answer
52 views

How can we say there is absolute collision in Baby-Step Giant-Step attack for RSA?

According to this paper, there is a Baby-Step Giant-Step attack for RSA encryption. Consider the following Baby Step, Giant Step attack on RSA, with public modulus $n$. Eve knows a plaintext $m$ and $...
2
votes
2answers
114 views

RSA OAEP Error Detection Probability

With reference to this question: First, when using padding (PKCS or OAEP), if the ciphertext has errors in transmission we'll always get an error at the decryption process? where the answer is: Yes,...
0
votes
0answers
17 views

Is there any tutorial that implements Shamir's identity-based signature scheme? [migrated]

I was wondering if out there is any tutorial which explains step by step how to implement the Shamir IBS in any programming language? Or, maybe if there is a code implementation to which I could refer?...
1
vote
1answer
25 views

PKCS#7 Signed Data contains always different signature

I am wondering why CMS (PKCS#7) Signed Data contains always a different signature of the original data when the SHA256withRSA signature algorithm is used. (using ...
0
votes
0answers
9 views

RSA-SHA1 problem [migrated]

I need to create a RSA-SHA1 signature in nodeJS, I am using the following code ...
3
votes
1answer
136 views

Security of RSA variants with $e=n-2$ and $e=n$

RSA as defined by PKCS#1v2.2 allows public exponent $e=n-2$. And textbook RSA was born with $e=n$ (see second bullet here). Are these variants essentially as secure as (textbook) RSA with fixed $e$? ...
4
votes
2answers
96 views

RSA algorithm: Must $e$ be less than $\varphi(N)$?

I understand why $e$ must be co-prime to the totient of $N$, but I see in many explanations of RSA that $e$ should be less than $\varphi(N)$. Is there a reason for this? Is it for ease of a small ...
1
vote
1answer
57 views

Why is data signed with SHA256-RSA-PKCS and digest signed with RSA-PKCS different?

I need to sign some data using RSA. I have the digest that I can sign but the signature turns out different from the signing source data. There is data in data.bin and its sha256 digest in digest.bin <...
1
vote
1answer
55 views

If we have multiple unique RSA signed messages produced from the same private key, can we always find new valid signatures?

Say Alice publishes $t$ unique signed messages with her private key $d$, $$ m_1^d, m_2^d, m_3^d, ... , m_t^d \mod n $$ For $t = 2$, we have $m_1^d, m_2^d \mod n$ and if we let $x \equiv m_1m_2 \mod n$ ...
2
votes
3answers
78 views

Reason for squaring and not arbitrary exponentiation in Wesolowski and Pietrzak verifiable delay functions (VDFs)

I'm working at understanding the Wesolowski and Pietrzak RSA group based VDFs (verifiable delay functions). These basically work by requiring the prover to do a bunch of repeated squaring within a ...
4
votes
0answers
66 views

Can RSA re-encrypt a message without decrypting it?

The goal of this question is to allow a server/proxy to forward an encrypted message without being able to read it with this procedure being transparent to the original sender and receiver. Assume we ...
1
vote
2answers
77 views

RSA algorithm implementation

$$m^{ed} \equiv m \bmod n$$ $n =pq$, so by Chinese Remainder Theorem it is equivalent to $$m^{ed} \equiv m \bmod 𝑝, m^{ed} \equiv m \bmod q$$ where $n=p\cdot q$ So how did 2 come from 1 by the ...
0
votes
1answer
50 views

RSA - Recover private key if each letter is encrypted separately and we got n,e,m

I'm curious if is it possible to recover a private key from insecure RSA implementation - each letter of the plaintext is encrypted separately (and no padding). Let's say I have plain-letters, cipher-...
0
votes
0answers
28 views

How to falsify RSA signature with known message [duplicate]

I have a question about the RSA signature. Let's say Alice has $(d,n)$ as the private key and $(e,n)$ as the public key. In order to sign a message $m$, Alice computes $y = m^d \bmod n$ and sends $(m,...
0
votes
2answers
95 views

Is an efficient integer factorisation algorithm a threat to security anymore?

Nowadays, private key systems like AES have replaced RSA. Even for digital signatures, people mostly use ECC, so even if an efficient integer factorization algorithm is made, would it be a threat to ...
2
votes
0answers
38 views

What grade of protection does a private key's passphrase provide at best?

Does a passphrase with high entropy provide the same level of security as the private key itself? General scenario: An attacker has access to a private key file that is protected with a passphrase ...
0
votes
0answers
37 views

Does Right-to-Left Modulus Exponential Technique make sense for RSA?

The theory for right to left modulus exponential technique is very straight forward if the explanation is using a small modulus n number. For example, $$3^{77} \bmod 11$$ In this example, we know that ...
0
votes
1answer
54 views

Why is RSA unsafe if N=pq can be factored? [closed]

I just started learning about cryptography and specifically RSA, and the texts I have read don't have a proof or explanation for why RSA is unsafe if you can factor N=pq, it merely asserted this. Is ...
2
votes
1answer
68 views

Is it possible to retrieve the original hash of a digital signature using a public key?

I am running a server that is receiving packets. Each packet is signed with an RSA 512 SHA-256 digital signature. I have a public key and exponent that I use to verify the digital signatures. I'm ...
0
votes
0answers
20 views

what is the difference between RSA and DHM mathematically? And why RSA is hard to break [duplicate]

This is my assignment question and I m looking for immaculate answers from crypto experts. The aim of the assignment includes the critical analysis of both algos and answers to the given questions in ...
7
votes
1answer
144 views

ECIES vs. RSA + AES

I am confused about the distinction between RSA and ECC (Elliptic curve) when it comes to encryption and would appreciate it if someone could confirm if my understanding is correct. When encrypting a ...
0
votes
0answers
41 views

How can we decrypt all RSA messages given a function that can efficiently decrypt a small percentage of all possible ciphertexts? [duplicate]

I saw this question in a paper and was not able to solve it. Assume that we are given an efficient algorithm called RSA_break() that can decrypt, without the ...
0
votes
1answer
68 views

How many public keys and private keys are needed for RSA?

I am just learning about RSA encrytion and I am somewhat confused. First two prime numbers $p$ and $q$ must be chosen and multiplied to get $n$. Then we compute Euler function $\varphi (n) = (p-1)(q-1)...
0
votes
1answer
70 views

Why in RSA do we use mod n rather than mod phi(p⋅q)?

When we pick $e$: $$e \in \{1,2,3,4,...,\phi(p\cdot q)-1\}$$ where $\gcd(e,\phi(p\cdot q))=1$. Similarly when computing $d$ which is the modular inverse of $e$ (the private key) we use the extended ...
0
votes
0answers
28 views

Alter signature post signing without the private key

There a plethora of signature scheme's but I am wondering if there are scheme's with the following properties: Given that you know the message, alter the signature with the public key in such a way ...
3
votes
2answers
309 views

Does it make any sense to sign a GCM authentication tag with RSA?

To achieve double insurance for authentication, can we sign the GCM final tag with using RSA? with RSA, no one is able to create his own tag since the private key is not known. However, according to ...
0
votes
1answer
53 views

Why RSA-sig authentication VPN need its own private key?

In my understanding, RSA-sig authentication only requires its own Public Key so that the peer authenticates it using Root CA's public key. But, strongSwan VPN configuration requires its own private ...
1
vote
1answer
49 views

initial value for RSA and SHA-256 signature encoding

As described in RFC 8017, RSASSA-PKCS1-V1_5 uses the following bytes during the encoding process : 0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00,...
0
votes
1answer
80 views

Are there any Cryptography Algorithms that involve Lots of Number Theory?

I am looking for a good, meaty cryptography algorithm that involves a good amount of number theory in which I can explore. I'm researching, and AES (Advanced Encryption System) seems interesting, but ...
2
votes
0answers
58 views

RSA: Find message (m) given that you know p,q, cp and cq where cp=m^dp mod p and cq = m^dq mod q

I have come across an RSA problem that goes like this: You have $p,q,cp,$ and $cq$. You know that $cp = (m^{dp}) \bmod p$ and $cq = (m^{dq}) \bmod q$ where $dp = d \bmod(p-1)$ and $dq = d \bmod(q-1)...
0
votes
1answer
50 views

RSA polynomial cubic root

Let's suppose we are given a linear polyonmial $$\begin{align}f(x) = ax + b\end{align}$$ where a and b is known which satisfies this equation $$\begin{align}y^3 - f(x) \equiv 0\mod(n) \end{align}$$ ...

1
2 3 4 5
45