Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [rsa]

an asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption.

1
vote
2answers
73 views

RSA padding: risk of using constants

Assume I want to make my RSA secure because I heard that textbook RSA, especially in conjunction with low exponents, is very risky. I decide to limit my message length to 100 and subsequently ...
5
votes
3answers
207 views

Can Shor's algorithm factor multi-prime numbers?

I know that Shor's algorithm can factor semi-primes ($N = p \times q \space, \{p, \space q \in \Bbb{P} \space \vert \space p, \space q \gt 0 \} $). Assuming that all prime numbers are so large that ...
0
votes
1answer
63 views

RSA calculate public exponent

Suppose I have two messages $m_1$ and $m_2$ as well as $c_1$ and $n$. It's standard RSA so $c_1 = m_1^e \ mod \ n$, $c_2 = m_2^e \ mod \ n$. Further assume the only information we have about e is that ...
-5
votes
0answers
45 views

RSA -Diffie-Hellman [on hold]

problem1: The security of the RSA encryption approach relies mainly on the difficulty of the prime factorization of large integer and the difficulty of calculating the Euler Totient function of large ...
2
votes
1answer
62 views

Discrete logarithm with exponentiation oracle

Suppose $(n, d)$ is an RSA private keypair. We know the public key only (wlog suppose it's $(n, 2^{16}+1)$ and we are given oracle $E$, decryption oracle for $(n, d)$. Is there any efficient algorithm ...
26
votes
3answers
157 views

Why does BitLocker not use RSA?

If understand correctly from this post and the Wikipedia page for BitLocker and TPM, by default, BitLocker uses symmetric cryptography like AES. However, TPM is capable of performing RSA encryption. ...
1
vote
0answers
73 views

RSA low exponent with padded plain-text

Considering a case, when modulus is large and hard to factor, exponent e=3 and there is a cipher-text which is created by padding plain-text with ...
2
votes
2answers
250 views

RSA find public exponent

Suppose I have an encryption oracle which can encrypt $m^e \mod n$ for any $m$. I know $n$ and I know $\varphi(n)$. However the public exponent $e$ is secret. Is it possible to figure out it's value ...
0
votes
0answers
48 views

I need help understanding and answering this question about RSA Enc/Dec [closed]

Let's assume, Alice's public key is ($N = 15,\space e= 3$), private key is ($N=15, \space d=3$). Bob sends message $m = 5$ by encrypting it with Alice's public key. Attacker Eve intercepts that ...
0
votes
1answer
52 views

Euler's totient function and Carmichael's totient function in RSA [duplicate]

I'm a high school student taking IB and I'm doing my EE on Maths, more specifically on the effectiveness of Euler's totient function and Carmichael's totient function in RSA. Am I right in thinking ...
0
votes
2answers
48 views

cryptographically signed streaming data

On a high level the question is: how does one cryptographically sign streaming data? Here is the context: a number of people are continuously streaming data to me the data is public and does not ...
-2
votes
1answer
87 views

RSA: why does $m^{ed}$ equal the original message?

Trapdoor functions are defined as that a secret key reverses the function. It seems to me more that it causes a cycle to repeat, similar to how $n^k \bmod k$, when $k$ is a prime number, equals $n$, ...
1
vote
2answers
82 views

How to implement correctly an Integrated Encryption Scheme?

I am developing a REST client (from an Android Point Of Sale) where I'm given a public RSA 2048-bit key and I need to encrypt transaction information. Since that single block cannot be encrypted (and ...
2
votes
2answers
81 views

Compute discrete logarithm mod $n=p \times q$ knowing factorisation

I read in a document that for a given $n = p\times q$ ($p$, $q$ primes), if you know $p$ and $q$ then you can easily solve the discrete logarithm problem, i.e. for fixed $a,b$, you can find $x$ such ...
1
vote
1answer
44 views

Forging RSA1024 signature with e=3 where hash is right justified

I am trying to understand (in the frame of exponent 3) how to calculate a "forgery" in the case where the desired result is: xxxxxxxxxxx[...]xxxxxxxxxxxxxxxxxxxxHHHHHHHHHHH[...]HHHHHHHH where HH = a ...
1
vote
0answers
51 views

Overcome MD5-RSA Signature verification

I asked this question already at the Information Security SO site, but my research on how to overcome this problem ended always on the crypto site. That's why I will try to find some help here :) I ...
-1
votes
0answers
42 views

is there any good idea that rabin rsa problem?

i study rabin asymmetric that p ≡ q ≡ 3mod4, when it decrypt Cipher Message, use Chinese remainder theorem and get four possibilities. my study book says that Receiver can choose m because he can ...
0
votes
0answers
45 views

How you find the unpadded short plaintext using RSA?

I am currently trying to understand how you find the unpadded short plaintext when you are using RSA. Please help with explaining the process and so I can understand this topic more.
1
vote
0answers
82 views

RSA encryption extremely large public exponent

I'm trying to do learn a bit about RSA by doing CTF's and now I am doing one problem probably more than 7 hours so I would really appreciate a hint here from an expert. I have an encrypted message $c$...
0
votes
1answer
231 views

Can not use big prime number for pair of key of RSA Algorithm [closed]

I'm new to cryptography. I have a binary image with 64x64 pixel in size. I perform an encryption to the image using RSA Algorithm. I wanna ask something bothering me, why can I not use big prime ...
0
votes
0answers
49 views

RSA Signature Forgery - Low Public Exponent + Improper Padding Validation? [duplicate]

Consider the following custom crypto: We have a signed message M1 with corresponding signature S. We have the 1024-bit modulus <...
0
votes
0answers
28 views

Signature Generation with RSA PKCS#1 v.15

I am trying to validate my RSA implementation for digital signatures with the test vectors provided by NIST. For now, I am focusing on the tests for signature generation (SigGen15) with the PKCS#1 v....
3
votes
2answers
957 views

RSA: Danger of using p to create q

Assume my prime generation is as follows: Pick a number $p$ between 1000 and 9999. $p=abcd$. Make sure $p$ is prime Construct $q$ such by taking the last 2 digits of $p$ and the first 2 digits of $p$,...
0
votes
2answers
67 views

What is the difference between RSASSA-PSS signing and RSA-PSS signing?

I read the RFC 8017 and understood the pkcsv1.5 and pss padding techniques. I understood that in RSASSA-PSS signing scheme the signature will be appended at the end of M. In some websites I read both ...
0
votes
1answer
38 views

Book request about elliptic curves, RSA and DSA

I understand that this question can be hardly downvoted, but so be it if someone gives me really useful references :) I wanna learn difference (deeply) between RSA, DSA, and ECC, especially I am ...
3
votes
1answer
57 views

Zero-knowledge proof for Paillier parameters

For RSA one can give a non-interactive zero-knowledge proof that RSA with parameters $(e,N)$ form a permutation and a proof of knowledge of the associated RSA secret key. For example, such a proof can ...
0
votes
1answer
60 views

RSA Blind attack help [closed]

I am trying the Blind signature attack against an RSA crypto system (we have the value of N and e). The system is defined as: ...
0
votes
0answers
6 views

Generating JWT RS256 signature with openssl [migrated]

I'm trying to sign a JWT token with the RS256 algorithm using openssl. Take the following example token: ...
1
vote
1answer
70 views

blind signature

Reading this paper, I have some questions about blind signatures What is the meaning for unlinkability of blind signatures? I searched wiki, but still cannot understand exactly. In blind signatures (...
1
vote
1answer
62 views

How reasonable is deriving the key a corpus of RSA-PSS signed messages?

Given access to a 2048 bit public key, a large corpus of 2048 bit plain text messages and their signatures (RSA-PSS with SHA256 as the hash and MGF) are any of the following statements correct: ...
2
votes
0answers
41 views

man-in-the-middle attack on text-book RSA PKE

I am attempting to solve the following problem: I know the following: 3 messages are being sent between Alice and Bob, all messages are encrypted with the known public key $(d,N)$: Alice sends ...
4
votes
3answers
553 views

How to verify if g is a generator for p?

For learning purpose, supposed I have a 16-digit prime which is 2685735182215187, how do I verify if g is a generator? (p is supposedly a special kind of prime)
4
votes
1answer
70 views

Comparison of security definitions for signatures

The two main security definitions for signatures are EUF-CMA and the strong version of it sEUF-CMA. What I see that their difference is that in EUF-CMA experiment, the adversary needs to produce a ...
2
votes
0answers
28 views

RSA: Blinding versus fixed-time computation

For RSA, what is the standard solution against timing attacks? I know about RSA blinding as one solution. Another solution is to always compute both the squared value and square-and-multiply values, ...
2
votes
0answers
65 views

Is it possible to check if a number is the product of two primes without factorizing it?

I have a large number which I suspect may be a private RSA key (although its size, at 613 bits, seems a bit unorthodox). I have started to run a factorization algorithm on it, and after a few hours ...
0
votes
1answer
103 views

RSA-OAEP Padding scheme

Honestly I'm really confused about padding in RSA scheme. I don't study computer science, and I'm a beginner learning cryptography (self-taught). Can anyone give me suggestions?
0
votes
2answers
64 views

How does AWS Secret key and access key work

Those keys are too short to be public/private RSA keys. What are they? How does it use them to authenticate the client? My guess is: AWS access key ID is a form of unique user/account identifier AWS ...
3
votes
1answer
300 views

Is there a symmetric-key algorithm which we can use for creating a signature?

I know that in the asymmetric-key algorithm the RSA signature exists but what about the symmetrical ones?
0
votes
1answer
44 views

RSA: Derive modulus from known ciphertexts encoded with same keypairs

I have two ciphertexts $c_1 = m_1^e \bmod n$ $c_2 = m_2^e \bmod n$ I know $c_1, c_2, m_1, m_2$ and $e$. Is there a way to derive n from this? I first thought Franklin Reiter but I'd need an $n$ for ...
0
votes
0answers
51 views

Deterministic generation of RSA keys for IPFS / OrbitDB [duplicate]

I am in the process of working on a decentralized application using IPFS and OrbitDB. IPFS uses 2048 bit RSA keys for the Node runtime peer-id and secp256k1 for read/write access in OrbitDB. For ...
0
votes
1answer
60 views

Extended Euclidean Algorithm in RSA [duplicate]

I am trying to solve an RSA problem. In order to calculate $d$, I have to calculate $d$ with $e=3$ and $$d\cdot e\equiv1 \pmod{40}$$ Obviously the answer is $d=27$, but I want to solve this with the ...
0
votes
1answer
52 views

Secret modular exponentiation with chosen modulus

Let $e$ be a secret value and $n$ a public 2048-bit RSA modulus. Consider the RSA encryption under the key $(e, n)$ with unknown $e$. The goal is to decrypt a given ciphertext $c=m^e \pmod{n}$ to ...
3
votes
1answer
73 views

What are the chances of an RSA signature collision?

My understanding is: fundamentally it should be hard to produce a different message with the same signature. Therefore chance of collision should be low. But what exactly is the probability of a ...
2
votes
1answer
33 views

If TDP exist then CCA-secure PKES exist?

My cryptography slides describe several relations between cryptographic problems. I don't still have a good justification on the following: If trapdoor permutations exist then CCA-secure public key ...
1
vote
0answers
31 views

Why doesn't the JOSE suite/JWA include ECIES?

The JOSE suite specifics use of RSA-OAEP (for when one party has an RSA key) and ECDH (for when two parties have EC keys) in JWA. Why doesn't it include ECIES? It seems like a way to derive a key ...
2
votes
1answer
67 views

Secure multi-party computation for digital signature

Is there any practical algorithm that will allow to use public key cryptography (RSA or ECC) in the following way There are N parties. Up to M are malicious adversaries (were trusted, but got taken ...
3
votes
1answer
138 views

Fermat's factorization method on weak RSA modulus

Given a public key for RSA, I have extracted the modulus which looks like this: ...
2
votes
2answers
668 views

Can you recognize a low private exponent from a public key?

In the RSA cryptosystem, Wiener, Boneh and Durfee showed that low private exponents can be efficiently recovered. Is it possible to see from a public key alone whether the private exponent (d) is ...
1
vote
1answer
146 views

Factoring RSA weak modulus

Given a public key for RSA, I have extracted the modulus which looks like this : ...
2
votes
1answer
92 views

Looking to verify my understanding of RSA math

I want to explain RSA to a programming audience with no cryptography background and I want to be sure my explanation is correct. The goal is to help them understand how RSA works under the hood. You ...