Questions tagged [rsa]
An asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption with proper paddings.
2,410
questions
2
votes
0answers
34 views
Is it possible to have a shared secret without any party knowing all the parts?
I believe with Shamir’s Secret Sharing Scheme, I can create an n-part secret and distribute each of those parts to n parties. ...
0
votes
0answers
58 views
Unable to factorise the modulus from public key to extract a private key
I have a public key but struggling to get the modulus from it
...
1
vote
0answers
13 views
SSH Server Configuration Best Practices? [migrated]
I hope this is the right place to post this.
I have been tasked with reviewing the settings of an SSH server, I'm currently trying to figure out what are the best practices, and I'm having a bit of ...
0
votes
2answers
71 views
what are security reductions of symmetric-key algorithms?
I was reading Wikipedia page of post-quantum cryptography. It says that it is desirable for cryptographic algorithms to be reducible to some particular mathematical problem, that is intractability of ...
0
votes
1answer
60 views
Eavesdropping attack on text-book RSA encryption with public nonce
Consider the following scenario: Alice has a secret key and public key pair for text-book RSA (denoted $\text{sk}$ and $\text{pk}$ respectively). Bob has an authentic copy of $\text{pk}$. The ...
3
votes
1answer
144 views
What is the NTRU parameter equivalent to security level 112, 128 and 192?
I came across this paper which mentions this table, which states that NTRU 347 is equivalent to 112 bit security level
However, in this paper, Choosing parameters for NTRU mentions that NTRU-401 is ...
0
votes
1answer
64 views
Pretty much confused about pretty good privacy-:
Authentication-:
I understand that authentication is basically digital signature. But what I don't understand is how it has been explained here specially the RSA key part. It is leading me to huge ...
-1
votes
2answers
82 views
How to decrypt a file using RSA and just a public.pem file?
I have an encoded file and a public.pem file. Is it possible to decode the file using the public.pem file or do I have to start looking at private keys?
I tried https://github.com/Ganapati/RsaCtfTool ...
2
votes
1answer
68 views
Need help to understand RSA common modulus attack to get private key
I'm learning about common modulus attack and learned that public modulus attacks can find out the private key.
Assume there are 2 users with public and private keys $(e_1, d_1)$ and $(e_2, d_2)$. ...
4
votes
1answer
143 views
Fake non-membership proof in RSA accumulator
As explained in this answer, if one knows the trapdoor (factorization of modulus $N$) in an RSA accumulator, one can generate fake membership proofs. Does the same apply to non-membership proofs? More ...
1
vote
1answer
636 views
RSA signing - does EMSA-PKCS1-v1_5 padding need to be verified?
I am working with an embedded system that accepts firmware updates only if they are validly signed by a particular 2048-bit RSA private key (the embedded system's bootloader knows the corresponding ...
4
votes
1answer
86 views
Would being able of factoring integers efficiently have some consequences over Elliptic Curve Cryptography?
Let's assume you can factor integers in a very efficient manner. Would that endanger the security of e.g. elliptic curve cryptography, or is there no link between the two ? You can often read that ...
1
vote
1answer
52 views
conflicting definitions for dP / dQ and exponent1 / exponent2 in PKCS 1?
In Section 2 dP and dQ are defined thusly:
...
Gilles 'SO- stop being evil'
15.4k3 gold badges40 silver badges79 bronze badges
1
vote
0answers
52 views
Does SHACAL-2 have collision resistance?
I am trying to find if a design of mine SHACALheader(payload) ⊕ header will have more collisions than if we just concatenate Hash(datagram) := H( H(header) || H(payload) ) ?
I am fairly new to ...
3
votes
1answer
129 views
Update non-member witness in RSA accumulator
According to study of "Universal Accumulators with Efficient Nonmembership Proofs", I don't understand exactly how to update non-member witness in construction 4.2.
In the addition step, I understood ...
1
vote
1answer
197 views
Is there much difference in a RSA-4096 over RSA-3072 for support/speed and security?
I am in the process of created a signing certificate and i have an option of RSA-4096 or RSA-3072.
Is there much difference in security between the two? I know people say RSA-3072 should be good until ...
0
votes
0answers
30 views
How is this step being calculated and why is that getting the factors is able to determine private key or universal forgery?
https://link.springer.com/content/pdf/10.1007/3-540-49649-1_18.pdf
In class I, why (4) implies $g\equiv 1 \mod q$
Also even though I get $p$ and $q$ it still can't get $ord_n(g)$ without trying out ...
0
votes
1answer
39 views
How to find iteration exponent in a cycling attack?
In Simmons and Norris paper they demonstrate the cycling attack with the following example:
p = 383 q = 563 s = 49 and t = 56957 ( a prime)
The attacker knows the publicly available r = pq = 215,629 ,...
39
votes
3answers
89k views
Calculating RSA private exponent when given public exponent and the modulus factors using extended Euclid
When given $p = 5, q = 11, N = 55$ and $e = 17$, I'm trying to compute the RSA private key $d$.
I can calculate $\varphi(N) = 40$, but my lecturer then says to use the extended Euclidean algorithm to ...
-3
votes
0answers
39 views
How do you quickly find D? (RSA) [duplicate]
with small primes under 1000 each i can find D in a matter of less than 1 second but anything above 1000 seems like it could go on forever!
right now I generated huge primes (p = 9504941263, q = ...
1
vote
1answer
52 views
Verifiable Delay Function: Trusted Setup
Efficient Verifiable Delay Function paper suggested that there is two way to construct the group. One of them requires trusted setup in the sense whoever constructs the RSA unknown group order needs ...
10
votes
8answers
13k views
Cracking RSA (or other algorithms) manually by a savant
RSA cryptography strength comes from the hardness (or so we believe) of factoring big numbers. For key lengths over 2048 bits, it is infeasible for current or near-future computers to factor those ...
6
votes
3answers
354 views
Decrypting small integers under RSA
Let $(n,e)$ be an RSA public key. Suppose $c = m^e \pmod n$, where $c>1$ is a very small integer. For concreteness, say $c=2$ and that $e = 65537$.
Is it hard to find $m$ under the RSA assumption (...
2
votes
1answer
108 views
Value of $\varphi(n)$ and $\lambda(n)$
Is it true that $\varphi(n)$ is generally larger than $\lambda(n)$ for the same $n$? If so, can anyone give me a proof?
0
votes
1answer
52 views
Generating a SHA256 pkcs1v1.5 Blind RSA Signature using Chaum's Blind Signature Scheme
I am a noob to cryptography in the sense that I have very less understanding as to how RSA encryption schemes work in practice. However I do understand the theoretical foundations of RSA cryptography ...
0
votes
1answer
55 views
How to ensure the data comes from verified source without using asymetric encryption
I'm building a project that is remotely controlled using LoRa and I want to ensure, that nobody can imitate my transmitter and send packets to my receiver. Just encrypting sent data is not enough ...
3
votes
0answers
79 views
No Final subtraction in Word-level Montgomery Multiplication
I am trying to make an RSA module in VHDL, which in turn will be deployed to an FPGA. I am trying to implement a full Montgomery algorithm which means that I am working with the Montgomery ...
3
votes
1answer
52 views
Question about white-box rsa algorithm
I found a scheme for white-box RSA. It seems to protect the input and output of modular operations.
I'm curious about how to analyze the security of this solution.
Does anybody know anything about it?
3
votes
2answers
107 views
Why is confusion and diffusion never talked about in asymmetric crypto?
While talking about symmetric encryption schemes like AES we always have a goal of achieving confusion and diffusion. But when it comes to asymmetric encryption schemes like RSA, DH etc. we never talk ...
1
vote
0answers
53 views
Comparing complexity of RSA decryption with/without CRT
(Cross-listed on math stackexchange, received no replies)
For context, this is a homework question from an assignment already turned in. I am looking for better understanding of the concepts involved, ...
1
vote
1answer
74 views
What are those RSA Challenges, DES Challenges and RSA Factoring Challenges
Can someone explain the differences between the DES challenge, the RSA challenges, and the RSA factoring challenge? What were the aims?
I think the factoring challenge was to encourage research, the ...
1
vote
1answer
127 views
Why does Shamir's Trick for RSA Work
I have read that Shamir's trick can protect RSA with CRT against fault attacks. However, it is not clear to me why the following equations
$$
s_{p}^{*}=m^{d \bmod \varphi(p \cdot t)} \bmod p \cdot t \\...
3
votes
3answers
326 views
Is there an easy way to make textbook RSA secure enough so it can be used in real life?
I have written a raw (textbook) RSA implementation (just for fun) and I wonder is there an easy way to make it secure enough so it can be used in real life (without implementing OAEP+ and RSASSA-PSS)? ...
3
votes
2answers
203 views
Is it ever OK to to sign RSA messages with padding random bytes?
If a message is padded with cryptographically secure random bytes, is there any reason why this would be less secure than the standard signature padding schemes (PKCS1 v1.5 and PSS)? To give context ...
1
vote
1answer
78 views
Multiuser encryption, singleuser decryption [duplicate]
I have an hybrid encryption (RSA, AES) for a file sharing project I am working on, where I use a single public key for encryption on the sender side and corresponding private key for decryption on the ...
17
votes
5answers
5k views
Why is RSA encryption key based on modulo $\varphi(n)$ rather than modulo $n$?
While calculating RSA encryption key we take modulo $\varphi(n)$ rather than modulo $n$. I can’t understand why it’s done this way.
0
votes
1answer
95 views
Does the signature length of RS256 depend on the size of the RSA key used for signing?
The following NodeJS code, when run (v16.8.0), logs 512 to stdout.
...
0
votes
1answer
35 views
Simple Key Exchange, One Server
I am trying to better understand how TLS works. I understand in the normal use case you need various random values generated and used in the key exchange, to prevent some MITM reusing a previous ...
1
vote
2answers
170 views
DHKE Square and Multiply
Given is a DHKE algorithm. The modulus 𝑝 has 1024 bit and 𝛼 is a generator of a subgroup where 𝑜𝑟𝑑(𝛼)≈2160.
Assuming the public keys have already been computed, how many number of modular ...
7
votes
1answer
152 views
How bad is it to leak $k$ in RSA?
In RSA using a small public exponent $e$ such as $65537$, how bad is it if the value $k$ leaks? $k$ as in the following equations:
$ed - 1 = k \phi(n)$
or
$ed - 1 = k \cdot \operatorname{lcm}(p-1,q-1)...
Gilles 'SO- stop being evil'
15.4k3 gold badges40 silver badges79 bronze badges
3
votes
1answer
2k views
May and Coron's algorithm for factoring knowing RSA private key
According to this and this paper from Alexander May is possible to factor given the knowledge of the RSA private key.
This is possible via Coppersmith and LLL reduction.
Now I am trying to implement ...
1
vote
3answers
122 views
How can a recipient recognize which encrypted messages are intended for them?
Let's say there's a decentralized email service where parties' public keys are known. A sender sends a message to a recipient by encrypting via RSA with the recipient's public key and posting the ...
26
votes
5answers
31k views
Why is it important that phi(n) is kept a secret, in RSA?
Why is it important that $\phi(n)$ is kept a secret, in RSA?
0
votes
1answer
71 views
RSA: why $( e^{-1} ~\text{mod}~ n \cdot \varphi(n)) ~\text{mod}~ \varphi(n) = e^{-1} ~\text{mod}~ \varphi(n)$ holds for a specific setting of RSA
Let $p,q$ are primes and $n = pq$ as in every RSA setting and now use a random $e$ that holds the following properties
$gcd(e, \phi(n)) \neq 1$
$(e^{-1} ~\text{mod} ~\phi(n))^{4}\cdot3 < n$
$e^{-1}...
0
votes
1answer
38 views
RSA Blind Signatures Secure Implementation
note: I am not a crpytographer
I want to check if my RSA Blind Signatures Implementation is secure to be used in a production-stage application and I also have some questions which I would be so ...
0
votes
1answer
153 views
Is a RSA private key leak possible if I both sign and decrypt? [duplicate]
Is it possible to leak private key data if attacker control signing request ?
Everyone know $N$ and $E$ because they are public.
My server is designed to decrypt incoming request which is encrypted ...
0
votes
0answers
110 views
Textbook RSA meet in the middle time complexity
Hello,
I have a question regarding time complexity of meet in the middle attack on textbook RSA encryption. Let's suppose that I try to encrypt symmetric keys of different length with no padding using ...
1
vote
1answer
217 views
Finding RSA private exponent with a chosen ciphertext attack?
Let's say there's this blackbox app that has a known modulus $N$, private exponent $e$, and takes ciphertext $C$ encrypted against $N$ and $e$ input and outputs plaintext $M$.
The encryption is done ...
0
votes
1answer
113 views
Why a private key is used to encrypt hash in digital signing
In common RSA encryption, a public key is used to encrypt message, and private key decrypts it. However, in digital signing, it's the other way around: Bob hashes his message, then encrypts the hash ...
1
vote
2answers
81 views
RSA encrypt an AES key. What about the AES IV?
I need to securely pass an AES key to a remote client. What I did so far is to generate a random AES key and encrypt it using the RSA public key of the client (PKCS#1 v1.5 padding is taken care by the ...