Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [rsa]

an asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption.

0
votes
1answer
16 views

RSA: Is it possible to recover the plaintext given that we have the ciphertext and the public key?

The $N$ and ciphertext are huge number that is more than 600 digits long. I'm trying to find the prime factors of $N$ in order to get $p$ and $q$. Using $p$ and $q$ I can get $\phi(n)$. And using $...
0
votes
0answers
28 views

Store the public key and private key [on hold]

i want to implement digital signature scheme in my form sign up in my web, and i read all PKCS from PKI but it made me little confused. i have many questions, where i store my public and private key ? ...
0
votes
0answers
21 views

RSA-based encryption scheme and random oracle

I don't really get how this problem should be solved. My main issue is with the random oracle generally, a short explanation of ROs and how they are used in such proofs maybe with this example will ...
0
votes
2answers
48 views

Why does adding PKCS#1 v1.5 padding make RSA encryption non-deterministic?

I'm quite a beginner to cryptography, but have been implementing some encryption according to a specification over the last few weeks using the PyCrypto library. I've discovered that when encrypting ...
1
vote
0answers
58 views

CCA attack on RSA padded with random oracle

I'm trying to do the ex 11.15 of the Katz-Lindell book. Consider the RSA-based encryption scheme in which a user encrypts a message $m ∈ $ {$0, 1$}$^l$ with respect to the public key $(N, e)$ by ...
0
votes
0answers
39 views

How to use a RSA cryptography authentication for raise cybersecurity? [on hold]

I follow multiple cybersecurity blogs where experts write about passwordless authentication using cryptography (general overview, an example of articles). In the same time, there are either enough ...
0
votes
0answers
28 views

Develop application using Hyperledger Fabric Java SDK [closed]

I'm modifying an application which uses RSA keys to encrypt and decrypt symmetric keys (which are used to encrypt files). I'm trying to substitute this feature of the central server with the ...
3
votes
1answer
85 views

Generating RSA signature, by manipulating shorter message signatures?

Given a server that can return me RSA sign for any plaintext shorter or equal length of the given plaintext (excluding the given plaintext), how can I fraud/get the sign of the given? $$sign = M^{d} \...
0
votes
1answer
110 views

What's the best block cipher mode of operation for RSA?

I know that you should never use RSA with any block cipher mode of operation, but theoretically, what's the best block cipher mode (safest) we can use with RSA encryption - without adding any kind of ...
0
votes
0answers
47 views

Verifying valid public key and finding private key? [duplicate]

A naive user of RSA has announced the public key $n = 2903239, e = 5$. Eve has worked out that $n = 1237×2347$. Verify that the public key is valid and explain why the private key is $d = 2319725$. [...
0
votes
2answers
88 views

How to create a private key using $n,e,d,p,q$ where $n$ is prime

Someone has incorrectly created a public/private key pair where $N$ (modulus) is a prime number. This makes $p$ and $q$ trivial as they they are $n$ and $1$. $d$ is solved from $d \cdot e = \bmod (...
0
votes
0answers
42 views

Digital Signature Verification failed using SHA256withRSA in Python [migrated]

I am trying to validate the digital signature with given certificate files for the offline aadhaar KYC verification application. This instruction is given in the documentation for the verification. ...
-1
votes
0answers
18 views

maskGenAlgorithm for RSA signature with PKCS1-PSS padding [migrated]

I am generating RSA signature using RSA_PKCS1_PSS_PADDING. I am setting digest algorithm as SHA256 using EVP_get_digestbyname() and EVP_DigestSignInit(). And salt length parameter as -1 using ...
1
vote
1answer
76 views

Why does RSA signature need padding?

Actually, I think I know why, but consider RSA2048 and SHA256. What about to, instead of padding, just use pbkdf2 with just 1 iteration to expand the 256bits hash to full 2048bits and use those ...
1
vote
1answer
124 views

RSA2048 smallest possible modulus

what is the smallest possible modulus for RSA2048? I generate a random data with I want to encrypt by a textbook RSA2048 and I'm not sure where the first 1-bit should be. According to OpenSSL source ...
2
votes
0answers
57 views

Concept for a RSA “repeater”. Is it sensible?

I have been using RSA signed/encrypted mailing a lot recently. Naturally, I wanted to use RSA mailing also on my phone, not only on my computer. However, I feel uneasy having my private key on my ...
1
vote
1answer
30 views

Using Yubikey to store PIN protected secret for disk encryption

I want to store a secret on Yubikey and used it for the disk encryption. The crucial is, I want it to be PIN protected. There are a limited number of PIN tries, and after three attempts the Yubikey ...
0
votes
1answer
63 views

How to break RSA signature on XOR of hashed blocks

I'm trying to figure out if there's a way of breaking or weakening the following method of signing long messages Given $M=m_{1}m_{2}...m_{n},\,\,|m_i|=64b, \,\,h=h(m_{1})\oplus h(m_{2})\oplus\cdots\...
4
votes
2answers
198 views

How to efficiently generate a random safe prime of given length?

A prime $p$ is said to be safe prime if $(p-1)/2$ is also a prime. How to efficiently generate a safe prime? I have written the following code in sagemath which generates a random safe prime of 1536 ...
0
votes
0answers
37 views

Find RSA modulus, given plaintext and ciphertext [duplicate]

I have a way to get a ciphertext corresponding to any plaintext for an RSA system. However, I don't have the public key and so, I don't have the values of the modulus $n$ and the public exponent $e$. ...
-1
votes
1answer
93 views

Creating multiple “public” keys from one private key

Is it possible to create a public key out of a private key, then create another public key from the first public key. And treat the first public key as a private key (So you have two levels of private ...
-1
votes
0answers
31 views

What happens if the message to be encrypted with RSA is not in the RSA group? [duplicate]

An element $x$ in the RSA group with modulus $N=pq$ must be $\gcd(x, N)=1$. What happens if we want to encrypt a message $m$ that is not $\gcd(x, N)=1$?
3
votes
1answer
66 views

Does choosing N to be product of safe primes avoid William's p+1 factoring attack on RSA?

In this post, I found that choosing RSA modulus $N$ to be product of safe primes avoids Willam's $p + 1$ factoring attack. Suppose $N = p \cdot q$, where $p$, $q$, $(p-1)/2$ and $(q-1)/2$ are primes. ...
2
votes
0answers
85 views

What are the known attacks on $\phi$-hiding assumption? How to chose its parameters?

$\phi$-hiding assumption states the following. Sample 2 random primes $e_0$ and $e_1$ in the range $[5, 2^{\lambda/4}]$. Sample $N = pq$ of length $\lambda$ ($p$ and $q$ are large primes of length $0....
1
vote
2answers
80 views

Why can't we find $d$ if we know $e$ and $n$ in RSA?

Say, we have RSA public key $(n,e)=(221,7)$, and the encryption of the message $m=12$ is $$c=m^e \bmod n= 12^7 \bmod (221) = 194 \bmod (221)$$ Can we find the $d$ by solving the equation; $$194^d ...
4
votes
1answer
596 views

RSA using 2 as a public exponent

I'm failing to see why 2 can never be used and what weaknesses would be associated with doing so. There's a similar question asking why it has to be in the form of $2^n$+1 but why not $2^n$
0
votes
1answer
42 views

RSA - are we able to encrypt into any possible ciphertext in $Z_n$ given a specific key?

Given a public key $(e,n)$, if we are free to choose the plaintext does that mean we are able to generate any possible ciphertext in $Z_n$ ? Because if we were given $e$ we can say that the ...
1
vote
1answer
73 views

Determine RSA modulus from encryption oracle

Suppose we have an RSA encryption oracle $E(m)$ which basically just calculates $m^e \mod n$ for a given message $m$. Here $e=65537$ is known but $n$ is not. Can we determine the value of $n$ without ...
0
votes
1answer
63 views

RSA - source and image - all are possible?

Given a key $e = 3$ (the public exponent for RSA) and a group of numbers, say $Z_n^*$ (the multiplicative group of $n = pq$, where $p$ and $q$ are primes as requested by RSA). I can find the ...
0
votes
0answers
28 views

Intuition for CL signatures security

I'm trying to understand why the CL signature scheme (PDF) works only under the strong RSA assumption. Other well known signature schemes like ECDSA, Schnorr and even RSA can be proven secure only in ...
-1
votes
0answers
50 views

Recovering e and n in RSA from multiple pairs of ciphertext-plaintext

I wanted to know if it's possible to recover the exponent and the modulus given that we encrypt different plaintexts with those same exponent and modulus (we can do so as many times as we want).
1
vote
1answer
94 views

Breaking RSA using known root

Sorry in advance if this question is silly. Suppose we want to break RSA, that is find the message $m$ s.t. $c \equiv m^e \pmod n$ Now suppose we know an $x$ s.t. $c \equiv x^e \pmod n$. Could we use ...
1
vote
1answer
44 views

Can a TLS certificate using ECC secp384r1 as PK algorithm uses RSA for signature

If a TLS certificate public-key algorithm is ECC secp384r1 or ECC prime256v1, is it possible to have RSA as a signature ...
0
votes
1answer
58 views

Does RSASSAPSS use RSA signature

I just need to know is it correct to classify the RSASSAPSS scheme and sha[256 | 512 | 1]WithRSAEncryption all under RSA ...
5
votes
1answer
850 views

In the RSA DES challenges, how did the contestants know they had found the right key considering they weren't given any plaintext?

If the contestants were given both the plaintext and ciphertext, it's straightforward. Just bruteforce all 56-bit keys until you find one that maps the given plaintext to the given ciphertext. But ...
3
votes
1answer
74 views

Is OAEP needed when encrypting a session (random) key using RSA?

My question is two parts: when encrypting a session key which is used to encrypt bulk data using a block cipher for example, is padding with OAEP really needed [i'm assuming the key is generated ...
0
votes
1answer
42 views

How to name a signature algorithm that has no hashed component

I have an API-based service that digitally signs messages with RSA or ECDSA (system decides during runtime). The input is base64 encoded SHA-256 hash and the output is: signature of this hash ...
-2
votes
1answer
102 views

RSA exercise with known $n$ and $e$

Bob decides to use $n = 697 \rightarrow 17 × 41$ and $e = 33$ as his public key for an RSA cryptosystem. Show that the decryption exponent is $97$. Find the encrypted form of the message $17$.
4
votes
1answer
743 views

Is RSA provably secure in the sense of Douglas Stinson's ``provable security''?

Here's a quote from Douglas Stinson: “[i]f a cryptosystem can be ‘broken’ in some specific way, then it would be possible to efficiently solve some well-studied problem that is thought to be ...
0
votes
1answer
36 views

Can we find the exact number given remainder of the numbers with mod m?

I have around 1500 numbers. The numbers $x_i$ are calculated as $x_i$=($p*t_i$) mod m. $p$ constant and same for all the numbers while $t_i$ are chosen randomly everytime. For example the given ...
3
votes
1answer
122 views

Break RSA given $N, e$ and lower half of $d$

I have full bits of public key $(n,e=65537)$ but from the private key, I have the lower half bits of $d$. Can I restore the whole RSA private key from that data and use it for decryption?
4
votes
1answer
135 views

The 9 lives of Bleichenbacher's CAT, it puts another scratch again

Bleichenbacher demonstrated a padding oracle attack against RSA implementations that follow the PKCS #1 v1.5. Through the years, there are various mitigation techniques developed as OAEP and limiting ...
2
votes
1answer
48 views

RSA engine with inaccessible private keys - susceptible to any attacks?

We are going to integrate some hardware accelerator for RSA into our next system on chip. This chip can accelerate the core RSA operation, i.e. modular exponentiation $y=A^x \mod(N)$. The private key (...
-1
votes
1answer
39 views

RSA limiting down the possible values for $n,q$, and $d$? given only $e$ and $p$ [duplicate]

Suppose someone forgot the value of $n$ and you only knew the values for $e$ and $p$. How could one go about limiting down the possible values for $n,q$, and $d$? I'm thinking to try and solve $\gcd(...
-2
votes
1answer
84 views

RSA find $q$ given only $e$ and $p$

Lets say hypothetically all one knew was a value of $e$ and a value of $p$. As an example, lets assume that $e = 13$ and $p = 67$. Would it be possible to find the value of $q$ from this equation? ...
0
votes
1answer
45 views

Send content to owner of gpg public key, nested content symmetric encryption

If I want to encrypt a text content file using a symmetric algorithm like AES, is there a standard format gpg will expect, where it can detect a symmetric key (encrypted with recipient gpg public key ...
0
votes
1answer
54 views

Equivalent RSA modulus for NIST P-192 and P-521 elliptic curves [duplicate]

At www.keylength.com, I found the following table of ECC field size and the corresponding RSA modulus recommended by NIST. ECC Modulus RSA Prime Size 160 1024 224 2048 ...
3
votes
1answer
141 views

Performing a dictionary attack on RSA/ECB with no padding

I have the exponent $e=2^{16}+1$ and modulus $n$ (154 digit number) of an RSA public key along with the ciphertext (64 bytes) encrypted using the same key with RSA/ECB and no padding. I am required ...
5
votes
1answer
237 views

RSA PSS security advantage

To my humble opinion, please correct me if I'm wrong, RSA-PSS (PKCS#1 ver 2.1) advantage over RSA as described in PKCS#1 ver. 1.5 is in its security proofs. Does this proof and the advantage is still ...
2
votes
3answers
60 views

For elliptic-curve cryptography, does a 256-bit key imply that $x$ and $y$ are each 256-bits or 128-bits?

In the wikipedia article, the claim is made that "256-bit elliptic curve public key should provide comparable security to a 3072-bit RSA public key". Since, in ECC, the public-key consists of a point $...