Questions tagged [rsa]
An asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption with proper paddings.
2,221
questions
9
votes
3answers
11k views
Is RSA-OAEP deprecated?
I need asymmetric pub/private keypair encryption in JavaScript. Web browsers support RSA-OAEP, which works exactly as I need. But there is a table which lists supported algorithms for web crypto at ...
2
votes
1answer
70 views
What is the overhead of GCM? And how are GCM tags signed by RSA/PKI?
I'm mainly trying to wrap my head around the pipeline of encryption, hashing and signing.
I've read over this question, describing the overhead of GCM, which I understand to be configurable for space-...
11
votes
2answers
2k views
More than one private key for RSA
In an RSA-encryption scenario, Bob's public key pair $(n, e)$ is $(143, 43)$. An attacker Mallory tries brute-force and comes to $d = 7$ as the private key.
The value of $φ(143) = 120$ is not known to ...
1
vote
1answer
39 views
PKCS RSA - Why do we need encoding
In the RSASSA-PKCS-v1_5 signature scheme, the first step is to perform an encoding on the hashed data. (0x00||0x01||PS||0x00||T).
Is this encoding important for security ? What happens if the hash is ...
7
votes
1answer
3k views
Are RSA signatures deterministic?
If I sign the word HELLO with the mechanism "NONEwithRSA" with the same private key, will I always have the same signature?
A Java example always return ...
2
votes
2answers
92 views
Actual RSA encryption & decryption of strings?
$K_{pub} = (n, e)$
$K_{pvt} = d$
Then
$E_{K_{pub}}(x) \equiv x^e \mod n$
Practically, when RSA is used to encrypt strings, what is the $x$ here? You cannot take it byte by byte because $\mod n$ will ...
2
votes
1answer
177 views
Short padding + known prefix RSA attack
Suppose I have a message in the form of:
$m = \text{prefix} \mathbin\| \text{secret} \mathbin\| \text{padding}$
We have:
$e=3$
$n$
$n_\text{padding}$ (length of the random padding, <$1/4$ of $m$)...
118
votes
7answers
72k views
How big an RSA key is considered secure today?
I think 1024 bit RSA keys were considered secure ~5 years ago, but I assume that's not true anymore. Can 2048 or 4096 keys still be relied upon, or have we gained too much computing power in the ...
4
votes
1answer
1k views
What use is the signature without the message under RSA?
Using RSA for signing & verification, is there a way to take a valid signature for an unknown message, and for someone else to generate a valid signature using a different key against the valid ...
2
votes
1answer
71 views
Textbook RSA signature forgery when e=65537
Searching about RSA signature forgery I came across this question.
In the answer, it is stated that
for small to moderate $e$ (including $e=3$ and $e=2^{16}+1$, often used in practice), it would be ...
10
votes
3answers
8k views
Anatomy of an RSA private key
I'm learning about OpenSSL and public key infrastructure and am curious about the structure of an RSA key and how it's related to its corresponding public key.
I can generate a private RSA key with ...
0
votes
1answer
57 views
0
votes
1answer
73 views
Finding p and q in RSA with a given n, |p-q|<10000
I've got an RSA encryption I need to crack, but to do it I need to find the p and q values of an N I am given - it's quite large, around 308 symbols.
I know that N is the product of primes p & q, ...
1
vote
2answers
77 views
RSA algorithm implementation
$$m^{ed} \equiv m \bmod n$$
$n =pq$, so by Chinese Remainder Theorem it is equivalent to
$$m^{ed} \equiv m \bmod 𝑝, m^{ed} \equiv m \bmod q$$
where $n=p\cdot q$
So how did 2 come from 1 by the ...
0
votes
1answer
34 views
Suitable hybrid encryption approach?
I need help for my bachelor thesis.
I have a general question regarding hybrid encryption in different ransomware. The hybrid encryption often uses symmetric and asymmetric encryption techniques.
...
0
votes
1answer
266 views
Finding MSB in RSA
Scenario:
Alice and Bob send each other encrypted AES (128) messages.
In order to change key, Alice has a public RSA key (2049 bits).
Bob has Alice's public key.
Bob picks a random AES key, encrypts ...
1
vote
3answers
80 views
How to devise cryptographic system with data-sharing ability and password reset
I originally posted this in the security.stackexchange forums but then I was directed to this one which seems more befitting for my question.
I am writing a C# .NET application. For my application the ...
2
votes
2answers
114 views
RSA OAEP Error Detection Probability
With reference to this question:
First, when using padding (PKCS or OAEP), if the ciphertext has errors in transmission we'll always get an error at the decryption process?
where the answer is:
Yes,...
0
votes
1answer
67 views
Why does RSA 1024 provide lower security level than EC256? [duplicate]
And why do we have to use big numbers for RSA? Is it because of some RSA restrictions like p=q=3 mod 4?
6
votes
1answer
365 views
Relation between factors and their sum on RSA
In RSA and other crypto based on prime factors. If I would know the sum of $p+q$, would it reveal any more information than just knowing $p\cdot q$?
Edit: I do not know either $p$ or $q$. The question ...
1
vote
1answer
52 views
Standard tools for deterministic RSA key generation using seed?
I'd like to resuse the mnemonic I have from bip39 for crypto in other domains such as ssh and tls, etc. Are there standard tools (ie, openssl) to deterministically generate rsa key/pairs given a seed ...
1
vote
3answers
96 views
What's the preferable encryption for large data and files in terms of speed and security other than AES?
First of all, I'm relatively new to encryption so please bear with me.
I'm looking for a way to encrypt large amounts of data only on my device, no need to transfer my encrypted files/data (10-20GB or ...
0
votes
1answer
97 views
Is there a problem with this specific RSA protocol?
So a protocol uses two random primes $P$ and $Q$ with the equivalent bit length of around 2048 bits, multiplies to form $N$. The encryption function in detail is:
$m^e \bmod\ N$
$(\text{512-bit-random-...
11
votes
1answer
852 views
Collision resistance of hash function built on modular exponentiation
Consider the following hash function family for hashing integers:
$Gen(1^k)$: generate 2 $k$-bit primes p,q. Let $n = pq$. Choose random $y \rightarrow QR_n$ and output $n,y$.
$H_{(n,y)}(x) = y^x \...
5
votes
2answers
1k views
RSA using 2 as a public exponent
I'm failing to see why 2 can never be used and what weaknesses would be associated with doing so.
There's a similar question asking why it has to be in the form of $2^n$+1 but why not $2^n$
7
votes
1answer
141 views
ECIES vs. RSA + AES
I am confused about the distinction between RSA and ECC (Elliptic curve) when it comes to encryption and would appreciate it if someone could confirm if my understanding is correct.
When encrypting a ...
0
votes
1answer
50 views
RSA - Recover private key if each letter is encrypted separately and we got n,e,m
I'm curious if is it possible to recover a private key from insecure RSA implementation - each letter of the plaintext is encrypted separately (and no padding).
Let's say I have plain-letters, cipher-...
1
vote
1answer
82 views
Research Guidance on Elliptic Curve Cryptography [closed]
I am a freshman who want to research elliptic curve cryptography.
There are a few questions I have:
Firstly, I am not sure about how I should narrow down the topic. Where should I focus on? Can I ...
1
vote
1answer
68 views
RSA PKCS#1 OAEP Padding Schema - padding 0 for first octet?
In this document, it shows the EM will have one zero octet padding prefixed.
...
3
votes
1answer
40 views
How to attack Oblivious Transfer from a malicious sender that can deviate from the protocol
I am looking at at the $1–2 \space \text{oblivious transfer}$ that is described here: https://en.wikipedia.org/wiki/Oblivious_transfer#:~:text=In%20cryptography%2C%20an%20oblivious%20transfer,Rabin.
I ...
1
vote
1answer
52 views
How can we say there is absolute collision in Baby-Step Giant-Step attack for RSA?
According to this paper, there is a Baby-Step Giant-Step attack for RSA encryption.
Consider the following Baby Step, Giant Step attack on RSA, with
public modulus $n$. Eve knows a plaintext $m$ and $...
3
votes
1answer
59 views
Private evaluation public quick verification VDF
Does anyone know of any VDF, that can be calculated by someone holding some private key in t sequential steps and is quickly verifiable in exponentially reduced step by anyone using some public key ...
2
votes
1answer
597 views
Can RSA with padding detect all errors in ciphertext?
I'm new in cryptography and there are a couple of things that i'm not sure if i understand correctly.
First, when using padding (PKCS or OAEP), if the chiphertext has errors in transmission we'll we ...
0
votes
0answers
17 views
Is there any tutorial that implements Shamir's identity-based signature scheme? [migrated]
I was wondering if out there is any tutorial which explains step by step how to implement the Shamir IBS in any programming language? Or, maybe if there is a code implementation to which I could refer?...
0
votes
1answer
106 views
Relationship between special RSA modulus and quadratic residue in CL (Camenisch-Lysyanskaya) signature
I'm studying the CL(Camenisch-Lysyanskaya) signature (A signature scheme with efficient protocol proposed by Camenisch-Lysyanskaya).
However, I cannot understand ...
3
votes
1answer
136 views
Security of RSA variants with $e=n-2$ and $e=n$
RSA as defined by PKCS#1v2.2 allows public exponent $e=n-2$. And textbook RSA was born with $e=n$ (see second bullet here).
Are these variants essentially as secure as (textbook) RSA with fixed $e$? ...
1
vote
1answer
23 views
PKCS#7 Signed Data contains always different signature
I am wondering why CMS (PKCS#7) Signed Data contains always a different signature of the original data when the SHA256withRSA signature algorithm is used. (using ...
0
votes
0answers
9 views
RSA-SHA1 problem [migrated]
I need to create a RSA-SHA1 signature in nodeJS, I am using the following code
...
19
votes
1answer
9k views
What is the history of recommended RSA key sizes?
One can find up to date recommended key sizes for RSA at NIST sp800-131A for example. In short, it suggests a key size of at least 2048 bits.
Is it possible to find a history of recommended key sizes ...
4
votes
2answers
96 views
RSA algorithm: Must $e$ be less than $\varphi(N)$?
I understand why $e$ must be co-prime to the totient of $N$, but I see in many explanations of RSA that $e$ should be less than $\varphi(N)$. Is there a reason for this? Is it for ease of a small ...
1
vote
1answer
56 views
Why is data signed with SHA256-RSA-PKCS and digest signed with RSA-PKCS different?
I need to sign some data using RSA. I have the digest that I can sign but the signature turns out different from the signing source data.
There is data in data.bin and its sha256 digest in digest.bin
<...
2
votes
3answers
77 views
Reason for squaring and not arbitrary exponentiation in Wesolowski and Pietrzak verifiable delay functions (VDFs)
I'm working at understanding the Wesolowski and Pietrzak RSA group based VDFs (verifiable delay functions). These basically work by requiring the prover to do a bunch of repeated squaring within a ...
1
vote
1answer
55 views
If we have multiple unique RSA signed messages produced from the same private key, can we always find new valid signatures?
Say Alice publishes $t$ unique signed messages with her private key $d$,
$$
m_1^d, m_2^d, m_3^d, ... , m_t^d \mod n
$$
For $t = 2$, we have $m_1^d, m_2^d \mod n$ and if we let $x \equiv m_1m_2 \mod n$ ...
0
votes
1answer
57 views
How to Update Non-Membership Witness upon deletion in RSA Dynamic Universal Accumulator
The Universal Accumulator paper mentions the following for updating non-membership witness upon member deletion.
Choose $r$ such that $a\hat x − rx ∈ Z$$2^l$
What is Z$2^l$ and how can we ...
0
votes
1answer
50 views
RSA polynomial cubic root
Let's suppose we are given a linear polyonmial
$$\begin{align}f(x) = ax + b\end{align}$$
where a and b is known which satisfies this equation
$$\begin{align}y^3 - f(x) \equiv 0\mod(n) \end{align}$$ ...
4
votes
0answers
66 views
Can RSA re-encrypt a message without decrypting it?
The goal of this question is to allow a server/proxy to forward an encrypted message without being able to read it with this procedure being transparent to the original sender and receiver.
Assume we ...
2
votes
1answer
115 views
Hard-core bits from RSA assumption
I am trying to understand better the hard-core bit property from the RSA assumption. The paper by Håstad and Nåslund shows that every single bit is hard-core. By the result itself, two or more bits ...
22
votes
2answers
12k views
Which attacks are possible against raw/textbook RSA?
The PKCS#1 standard defines multiple padding schemes for signature generation/verification (EMSA-PSS and EMSA-PKCS1-v1_5), and encryption/decryption (EME-OAEP and the less safe EME-PKCS1-v1_5).
...
0
votes
0answers
28 views
How to falsify RSA signature with known message [duplicate]
I have a question about the RSA signature.
Let's say Alice has $(d,n)$ as the private key and $(e,n)$ as the public key. In order to sign a message $m$, Alice computes $y = m^d \bmod n$ and sends $(m,...
0
votes
2answers
95 views
Is an efficient integer factorisation algorithm a threat to security anymore?
Nowadays, private key systems like AES have replaced RSA. Even for digital signatures, people mostly use ECC, so even if an efficient integer factorization algorithm is made, would it be a threat to ...
