Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

an asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption.

0
votes
1answer
38 views

Computing/using RSA modulus without knowing its factors

There are some protocols, e.g. this, that require parties to compute/use RSA modulus: $N$ without knowing it's factors or $\phi(N)$. One way of doing it is to use a trusted party. Question: Is ...
2
votes
1answer
63 views

Why RSA must make sure that $\gcd(e,\varphi(n)) = 1$ instead of $\gcd(e,n) = 1$?

By Euler's theorem, if $\gcd(e,n) = 1$, then $e^{\varphi(n)} \equiv 1 \pmod n$. But why does RSA need to make sure that $\gcd(e,\varphi(n)) = 1$?
1
vote
0answers
10 views

Asymmetrical encryption with multiple sufficient key-pairs [duplicate]

I have the following requirement: There are N public/private RSA key pairs. The encrypted data must be decryptable by any of the private keys alone, but not by any other key. For encryption, the ...
0
votes
0answers
50 views

Is it necessary to encrypt messages client side if using HTTPS? [migrated]

I am creating a messaging service for an app I'm developing and right now the data flow is as follows: Send: message sent to server => message encrypted based on user's public key and signed using ...
3
votes
1answer
680 views

RSA decryption with small exponent - no “public keys”

I have an unusual scenario where an RSA key pair is being used to protect the confidentiality of data in transit. The encryption exponent, the decryption exponent and the modulus are all kept secret ...
2
votes
1answer
42 views

Usefulness of OAEP with ECC

Does OAEP make sense for use in an ECC ElGamal cryptosystem? The way I see it, OAEP makes questionable sense even for RSA because even though it's a "all or nothing" transformation, many RSA ...
-4
votes
0answers
19 views

RSA questions need help encrypt message ASAAP [duplicate]

My questions is this It is given that : plaintext=...
0
votes
0answers
43 views

RSA encrypt plaintext using N,e [closed]

Is it possible to encrypt a text with given N,e? I tried to get P and Q out of N by factorizing it but it didn't work. Also, I tried to use Hastad's attack on it but didn't get anything useful The ...
-2
votes
0answers
16 views

How to implement RSA pkcs1 padding encryption in javascript using webcrypto API [closed]

I need to do encryption using web crypto API in Javascript. same as we do in java with RSA/ECB/PKCS1PADDING. which algorithm to use in javascript? whether RSA-OAEP is same as the given java algorithm? ...
0
votes
1answer
75 views

RSA - is it possible to find the modulus from both the private and public exponents?

Let $e$ be the public exponent (which is equal to $65537$) and $d$ the private exponent. Knowing the values of those two, is it possible to deduce $N$, the modulus, and if yes, how? Note: the value ...
1
vote
1answer
44 views

What if n of RSA is same for two people over the network? [duplicate]

I was just going through RSA encryption scheme and was trying to figure out how to do all maths. I was suddenly struck by the question that (e,n) is public to the people. How easy it becomes to attack ...
1
vote
0answers
78 views

RSA vulnerability when e is particularily large?

I'm trying to solve a problem that goes like this: c: ...
2
votes
0answers
37 views

Chinese Remainder Theorem and Elgamal

I am studying an encryption scheme which is Elgamal-like where I think CRT can help optimise the encryption and decryption but I am not sure if I am applying CRT the correct way. I have a cyclic ...
3
votes
1answer
74 views

RSA: deduce the public key from message & signed message [duplicate]

In RSA, is deducing the public key from the (message, signed message) pair possible? If so, how can it be done?
-1
votes
0answers
32 views

Trying to understand how openssl calculates IV and key from passphrase

Once I generate the encrypted private key, public key and ca certifcates from openssl for radius server. With sha256-pkdf2 and 3des I put these files in ubuntu system for eapol communication. I am ...
-1
votes
0answers
36 views

There is DH and ECDH, and DSA and ECDSA… why isn't there an Elliptic Curve iteration of RSA? [duplicate]

Diffie-Hellman has an Elliptic Curve variant (ECDH). Digital Signature Algorithm has an Elliptic Curve variant (ECDSA). RSA (to my knowledge) does not have an Elliptic Curve variant. Why? (please ...
4
votes
1answer
76 views

Random Masking of Padded RSA Ciphertext through homomorphism

I had asked a question related to this before: Oblivious Decryption: Decrypting with a private key, without knowing the message @rikhavshah has an answer, which I would like to discuss the security ...
1
vote
0answers
63 views

Textbook RSA Signature attacks (without message padding)

I have been reading as much as possible, but I haven't so far found anything exactly like what I'm looking for. I have a couple of questions (given what I know below): One, is it possible to find d? ...
1
vote
1answer
32 views

What is the encoding protocol for passphrase protected RSA private keys?

What is the protocol used to encode an RSA key protected with a passphrase? If I generate an RSA key with ssh-keygen -t rsa -b 4096 and do: ...
1
vote
2answers
57 views

signature with Bleichenbacher’s attack

I understood Bleichenbacher & ROBOTO attack, however I have some trouble understanding Section 3.5 of ROBOT attack which discusses retrieving private keys. https://www.usenix.org/system/files/...
0
votes
1answer
67 views

Is it Ok to reverse the usage of public key and private key

Well things like this, my coworker suggest exchange the private key between server and client and using public key to decrypt message privately, his reason is, this is just the same as normal usage, ...
1
vote
1answer
82 views

RSA How to find the private key to a given public key when n doesn't consist of two primes?

I have the homework to find to the public key (120, 3) the private key. I guess 120 is n and 3 will be e. So that $\lfloor\sqrt{120}\rfloor=10$ I can't find a matching prime number. So it gets more ...
-1
votes
2answers
95 views

side channel attack on RSA

A side-channel attack is any attack based on information gained from the implementation of Encryption protocol and by monitoring security-critical operations. Almost every encryption had a side-...
0
votes
1answer
52 views

RSA: Private key given public key, plain text, and cipher text with no padding?

Are there attacks which will return the RSA private key when the attacker knows the public key, plain text, and cipher text when no padding is used in the RSA algorithm? If yes, what are the known ...
4
votes
1answer
216 views

Algorithm to factorize $N$ given $N$, $e$, $d$

I have an RSA public key (public modulus $N$ and public exponent $e$), and the private exponent $d$ of matching private key. How can I compute $p$ and $q$, the primes factor of $N$ ?
2
votes
1answer
55 views

Does DROWN attack break 2048-bit key itself or just the plaintext encrypted with the RSA key

Does the DROWN attack enable breaking strong RSA keys (e.g. the 2048-bit key itself) or enable breaking the plaintext (i.e. pre-master key) that is encrypted with a 2048-bit (or any strong) RSA, if ...
6
votes
1answer
252 views

Why can we not use the group $Z_{p}^{*}$ for cryptography?

Sorry if this is a noob question, but for instance in ECDSA, we start by considering the field $\mathbb F_p$, whose the elements also form a group under multiplication. Why don't we just use this ...
-2
votes
1answer
65 views

RSA Time Complexity on Best Case, Average Case and Worst Case

I am currently learning the work arounds about RSA algorithm. I wanted to know the time complexity of the encryption part and decryption part on Best Case, Average Case and Worst Case. Im new in ...
3
votes
1answer
80 views

Equations modulo phi(n)

Let $n$ be an RSA modulus and assume one has the two following equations \begin{align} y_1 = (x+a_1)^{-1} \pmod{\varphi(n)}\\ y_2 = (x+a_2)^{-1} \pmod{\varphi(n)} \end{align} with known $y_1$, $y_2$, ...
0
votes
1answer
44 views

Certificate public key keyexchange, Which key exchange is used in browsers?

I have a question regarding the keyexchange happening in web browsers. If you check the certificate here on crypto.stackexchange you can go under details and see that the public key is type RSA (2048 ...
0
votes
1answer
59 views

RSA: large private exponent often yields large public exponent

In this answer to a question about choosing RSA's exponent (whether it is better to choose the private or the public exponent), user @Jus12 stated: When choosing $d$ first: [...] guarantees with ...
1
vote
2answers
93 views

Point of Diffie-Hellman key exchange when public keys are known [duplicate]

Since the basic version of Diffie-Hellman key exchange protocol is vulnerable to Man In The Middle Attack, some sort of authentication is needed. It was mentioned that RSA digital signature can be ...
1
vote
0answers
24 views

RSA attack, 1 message with different keys? [duplicate]

There is 1 message, it is encrypted with 6 different keys, each has E = 5. I tried various attacks, but they do not seem to work. Is it possible to receive a private key / encrypted message? Is it ...
1
vote
1answer
38 views

Counting the number of binary solutions of quadratic system

I have a quadratic system of equations related to a balanced RSA modulus $n=pq$ (i.e. $\log p\approx\log q$), and I want to give an upper bound on the number of solutions. Indeed, let $p_i,q_i$ be ...
0
votes
0answers
27 views

Why do we need a condition e < (p-1)(q-1) in generating the keys in RSA? [duplicate]

I think we are so familiar with the algorithm for generating the public and private keys in RSA: Choose two large prime numbers p, q. N = p * q Choose a random integer e such that 1 < e < (p-1)(...
0
votes
3answers
73 views

Why does decryption in RSA not fail with 2 different moduli?

In RSA, we choose $p,q$ and calculate $\phi(n)=(p-1)(q-1)$. We then choose a public key $e$, and calculate its inverse modulo $\phi(n)$: $d\cdot e=1 \mod(\phi(n))$. But then, when we decrypt a ...
0
votes
1answer
56 views

Padding RSA with random number

I known the post from here and here regarding RSA padding. I still don't understand why simple addition of the message with an random number and then encrypting the result with plain RSA isn't secure. ...
2
votes
2answers
101 views

Generate shared secrets using RSA

Before explaining my question, please let me introduce the scenario: There are 2 type of actors: 1 server and N clients Each actor has a RSA 2048 bit private/public key The server knows all the ...
2
votes
1answer
41 views

Can root and intermediate CAs use different asymmetric ciphers and key sizes?

For example, could a root CA use RSA-4096, one intermediate CA use RSA-2048, and another use ECDSA-256 (DH19)?
4
votes
2answers
47 views

Feasible to find two sets with the same RSA accumulator value if a prime representative hash function is used?

Consider the RSA accumulator scheme with random oracle as proposed by Barić and Pfitzmann, with the random oracle replaced by a secure hash function $H$ as follows. For a set $S$, the accumulator ...
0
votes
1answer
48 views

Signing with RSA-SHA256 algorithm using EC keys

Is it practical to sign a data using RSA-SHA256 algorithm with EC keys? I used a small NodeJS script and crypto module (uses openSSL internally) to test this and I could successfully sign the data ...
1
vote
1answer
61 views

Extended Euclidean Algorithm (back substitution)

I have found from the values of P (11) and Q(7) that n=77, (p-1)(q-1)=60 and that e=43 as it is relatively prime with 60. However, I believe the value I got for d (7) is wrong. Here is my workings ...
1
vote
1answer
85 views
0
votes
1answer
39 views

Same message space for different public exponents

What is the weakness, if there is any, of using the same message space for different public exponents (assuming e changes everytime)? Imagine I have a message space [0,n] where n is a 1024 bit number ...
4
votes
1answer
221 views

RSA given d and d = p

Assume we have a somehow unorthodox implementation of RSA whereby: $p$ and $q$ are chosen primes of length $n/2$ where $n$ is the number of bits desired in $N=p\,q$ and $$\begin{align} \phi &= (p-...
3
votes
0answers
52 views

Why do one-way accumulators use rigid integers as the modulus?

In the paper that introduced one-way accumulators, the author's justify their use of rigid integers as the modulus with the following: The advantage of using a rigid integer $n = pq$ is that the ...
1
vote
2answers
86 views

RSA public key of dead cryptographers

Two cryptographic schemes—RSA accumulators, and RSA-based Verifiable Delay Functions (VDFs) such as this one—require an RSA modulus to operate. These RSA constructions are secure if the trapdoor, ...
4
votes
0answers
44 views

RSALib prime generation - derive number of primes

I'm working on factorizing a ~450 bit key that I know has been generated with RSALib and thus is vulnerable to ROCA. Now reading the original paper, I can see that the primes are generated in the ...
0
votes
1answer
77 views

When do I need to use hybrid cryptography?

I need to provide confidentiality for a protocol. The protocol message size is between 100 bytes to 500 bytes. Do I need to use asymmetric encryption or hybrid cryptography?
0
votes
2answers
61 views

Do I need to send the RSA public exponent with the public key?

I used RSA to provide confidentiality for a protocol. As I know the public key of RSA has two values: $e$ and $n$. Of these two, $e$ usually has value 65537. When the public key is sent, does the ...