Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [rsa]

an asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption.

2
votes
1answer
81 views

Looking to verify my understanding of RSA math

I want to explain RSA to a programming audience with no cryptography background and I want to be sure my explanation is correct. The goal is to help them understand how RSA works under the hood. You ...
4
votes
1answer
2k views

RSA Blind Signature Attack

In Information Security Class I learned a non-adaptive chosen ciphertext attack using "blinding" but I just can't follow the proof and therefore can't reconstruct it. From what I've found out, it ...
0
votes
0answers
42 views

Factoring RSA weak modulus

Given a public key for RSA, I have extracted the modulus which looks like this : ...
-1
votes
0answers
32 views

RSA modular multiplicative inverse, calculation of 'd' doesn't look fool proof. Can any one with experience in RSA, explain me about this [duplicate]

In RSA, for calculating $d$, we have the $\lambda(n), e$ and we calculate $d$ such that $e d \equiv 1 \pmod{\lambda(n)}$. As per the Wikipedia example is given for RSA - the value of $e$ is 17, $\...
4
votes
2answers
105 views

Is it hypocritical to use AES-256 and RSA 2048 in the same application?

I see a common claim that AES-256 is the gold standard and is good future proofing, often in the same wind as "just use 2048-bit keys for RSA". Security documents seem to recommend both AES-256 and ...
0
votes
0answers
6 views
1
vote
0answers
67 views

Finding generator element for multiplicative group of order $n$ - feasible?

Given a multiplicative group of order $n$, how hard is it to find a generator element (such that all other elements can be expressed as powers of that generator)? What would be the complexity?
1
vote
1answer
57 views

Inverse of an element in a RSA group

Consider a RSA group $Z_N$ for $N=pq$, where $p,q$ are large prime numbers. Under strong RSA assumption, can an adversary efficiently compute the inverse of a random element $z$ from $Z_N$ without ...
1
vote
1answer
57 views

$m^b = z^b \pmod{n}$ - single solution $m = z$?

If i have the following equation: $$m^b = z^b \pmod{n}$$ Where all numbers are taken from the multiplicative group $\mathbb{Z}_n^*$. Suppose I know the values $z$ and $b$. Can I state that $z = m$, ...
7
votes
1answer
339 views

The 9 lives of Bleichenbacher's CAT, it puts another scratch again

Bleichenbacher demonstrated a padding oracle attack against RSA implementations that follow the PKCS #1 v1.5. Through the years, there are various mitigation techniques developed as OAEP and limiting ...
2
votes
1answer
58 views

GPG encrypt performance degradence for thousands receipients

I plan to use GPG to encrypt a small file (32KB) for very many recipient public keys (few thousands). I tested GPG with RSA and then ECDH public key encryptions. If RSA is very slow, with ECDH (nist ...
6
votes
1answer
118 views

Distinguishing generators of RSA primes and moduli

We are trying to distinguish two RSA prime generators: Prime generator 1 draw uniformly at random an integer $p$ with $2^{1023.5}<p<2^{1024}$, until it is prime output $p$. Prime generator 2 ...
0
votes
1answer
37 views

Using the same RSA key for verifying a website and digital signature

We have the (same) RSA key for verifying a website and for digital signature. A user would send a nonce encrypted using the public key, the websites returns the nonce by decrypting it using the ...
1
vote
2answers
199 views

If my server utilises an RSA based certificate, why does firefox think I am using Diffie Hellman?

I am not a beginner in crypto, but not that far from it, so please be gentle. I look after a web server app that I generated the SSL certificate for, and I used an RSA public/private keypair. When ...
0
votes
0answers
54 views

Is RSA in decline across the board?

From what I gather from the internet (source), the recommended practice for 2019 and beyond is to avoid RSA and use ECDH and ECDSA. Is this the general case?
0
votes
1answer
71 views

Storing passwords in a publicly available database

I have a public database where users need to store configuration files. The file can contain passwords. Everyone can read config files but only the server can read passwords in them. In the browser, ...
0
votes
0answers
23 views

To get 128-bit security for RSA, the modulus should be 4096 bits. How was that determined? [duplicate]

My understanding of security level is that for a crypto scheme to have n-bit security means it would take $2^n$ operations to break it. For something like AES with a 128-bit key, it's straight-...
0
votes
1answer
37 views

How can I verify certificate signature algorithm in TLS 1.3 using PSS?

I've read this post but I'm still unable to understand some things. I'm trying to verify that the signature algorithm used in the certificate matches the proposed list from the client. (As it's ...
3
votes
2answers
317 views

Encrypting between nodes that have RSA keys: Diffie-Hellman or random secret key?

I have two peers with RSA keys; they want to encrypt a non-trivially sized message between them, so I want a random AES symmetric secret key, which is encrypted with Bob's public RSA key, and sent ...
0
votes
0answers
35 views

Digital Signature using RSA [closed]

In digital signature using the RSA would it be possible if the receiver will be the one to generate the public and private key instead of the Sender?
2
votes
1answer
50 views

Find hash and signature algorithms used in an X.509 certificate signed with RSASSA-PSS

I'm trying to understand the new PSS scheme, but having trouble figuring out how to parse it properly. When receiving a certificate with OID of RSASSA-PSS, how can I know which hash and signing ...
2
votes
1answer
37 views

How to identify RSASSA-PSS from rsaEncryption OID?

Following the RFC 8446 it states that: RSASSA-PSS RSAE algorithms: Indicates a signature algorithm using RSASSA-PSS [RFC8017] with mask generation function 1. The digest used in ...
3
votes
1answer
100 views

Inclusion and Exclusion proofs in RSA accumulators

I am reading about RSA accumulators from this video and few other sources. I had a confusion whether the complete set is needed to construct a proof of inclusion/exclusion in an RSA accumulator or is ...
2
votes
2answers
4k views

RSA PCKS1 v2.1 RSAES-OAEP algorithm

Using RSA public key (n,e) the encryption of a message is c= (m^e) mod n and the corresponding message is decrypted as ...
-1
votes
1answer
971 views

What algorithm does .NET use to generate primes for RSA and how can I verify it?

There is an implementation of RSA in C# .net, but how can people know that this implementation is considering all the secury stuff conserning to RSA? For example I want to know what is the algorithm ...
2
votes
1answer
50 views

Is padding of the digest needed in SHA256 with RSA-2048 scheme?

For a signing scheme involving generating a $256$ bit digest using SHA256 followed by RSA with $2048$ bit modulus, the signature would always be 256 bit without padding even though sigantures of up to ...
0
votes
1answer
49 views

What is multi-prime RSA (RSA-MP)?

I found some related question but no real explanation of what it is and when and why to use it. What are the benefits and downsides and is it recommended?
18
votes
5answers
4k views

Is there a situation where RSA cannot be replaced with ECC + symmetric algorithms? If no, why do we still use it?

RSA is both an asymmetric encryption algorithm and a digital signature algorithm. However, in recent years, many cryptographic protocols (TLS, for example) have moved away from the use of RSA to ...
3
votes
2answers
73 views

Are relatively prime numbers used in RSA

We know that the Totient function is multiplicative. Which means that when $p$ and $q$ are relatively prime, then $\varphi(p q)$ is equal to $\varphi(p) \varphi(q)$. My question is, are only prime ...
0
votes
1answer
54 views

How do you get $d$ in textbook RSA

So people say to choose $d$ such that $e*d=1(mod((p-1)*(q-1)))$. However, $1\%$ anything always equals $1$. Maybe I am not understanding it correctly, but the only way to get $e \cdot d=1$ is just by ...
2
votes
2answers
87 views

Security of RSA for padding $\texttt{0x00|message|random_bytes}$

I've read this and this but I'm not understanding why padding a message with a simple random is not secure. For example, consider a 256 bytes modulus. We can agree that the first byte from the ...
0
votes
1answer
52 views

How does Euler's Theorem show that $(m^e)^d ≡ m \bmod n$

In this thread Henrick Hellström says that when $ed \equiv 1\ (mod\ \phi(n))$ then $(m^e)^d \equiv m\ (mod\ n)$. So I thought this is how Euler's theorem is related to RSA. But at least I thought that ...
5
votes
3answers
5k views

Why do we need Euler's totient function $\varphi(N)$ in RSA?

After we calculated $N = p * q$, we calculate $\varphi(N)$ and use it later to determine $e$ (PR) and $d$ (PU). But why? For decryption and encryption we only use $N$ and don't need $\varphi(N)$. So ...
4
votes
2answers
2k views

Why is padding the plaintext with a random string before encryption worse than OAEP / PKCS#7?

I'm reading about OAEP / PKCS padding used for PGP to turn deterministic algorithms like RSA from deterministic encryption to probabilistic encryption (randomness in the resulting output). That way ...
1
vote
2answers
199 views

Can an RSA (private) modulus contain (hex) zeroes?

Consider a public modulus that is supposedly 4096 bits. But since it contains two hex pairs of zeroes, i.e. ...:00:...:00... such that the bit length of the decimal value instead becomes 4093 bits, is ...
1
vote
0answers
44 views

In RSA, what is $P[x \notin \mathbb{Z}_N^*]$

In the RSA problem one tries to avoid to pick a message $x \in \mathbb{Z}_N$. Thus, one may ask the question: Given $x$ uniformly distributed over $\mathbb{Z}_N$ what is the probability that $x \...
3
votes
1answer
857 views

textbook RSA signature scheme security

Are textbook RSA signatures secure if an Adversary does not have access to ask signing oracle queries?
0
votes
0answers
30 views

Does public key encryption support a large message size? [duplicate]

I'm somewhat new to encryption. I see that the actual RSA sizes are 1024 and 2048? Can those key sizes support data blocks of 128 MB?
1
vote
0answers
68 views

What is the probability of $\gcd(e,\varphi(n))=1$, where $e$ is an odd number and $\varphi(n)$ is an even number with $ e<\varphi(n)$?

This is needed because I use a random function to generate the encryption key in RSA setting to generate random numbers and check if $\gcd$ is $1$.
4
votes
1answer
108 views

How to generate $k$ random numbers that add upto a number $d$ and are coprime with respect to $p-1$

This is something that is needed while generating additive shares ($D_i$) for decryption key (represented by $d$) where each additive share must be coprime with respect to $p-1$ i.e $\gcd(D_i , p-1) =...
35
votes
5answers
11k views

Does RSA work for any message M?

I decided to read the original RSA paper A Method for Obtaining Digital Signatures and Public-Key Cryptosystem because of a question I had about RSA (which is not the question I'm about to ask, but ...
1
vote
1answer
41 views

Using Yubikey to store PIN protected secret for disk encryption

I want to store a secret on Yubikey and used it for the disk encryption. The crucial is, I want it to be PIN protected. There are a limited number of PIN tries, and after three attempts the Yubikey ...
0
votes
0answers
14 views

Python, Encript a message with two different public keys. (Crypto.PublicKey ) [migrated]

as a title I would like to use python to encrypt a message with two different private keys. In this situation I am using a module called Crypto.PublicKey . In the following code, I can do the ...
12
votes
2answers
655 views

What motivated the creation of RSA and ECDH?

Recently I've been learning about cryptography and so far I am loving it. However, there are some things I do not comprehend. As far as I know, RSA was published in 1979 while New Directions on ...
6
votes
1answer
4k views

How do RSA and ECDSA differ in signing performance?

Signature algorithms with elliptic curves have smaller output sizes compared to RSA for the same level of security. What about the processing time to generate a signature ? I've seen figures giving ...
2
votes
1answer
69 views

Converting Ciphertext to a Number in RSA

I've been looking into RSA and the attacks against weak implementations of it, such as when $e$ is small and there's no padding. On Wikipedia, the following attack is outlined for small $e$ values: ...
0
votes
1answer
77 views

In RSA, given $n=100$ and $e=13$ ,Encrypt and Decrypt the plain Text “SECRET”

Is this question valid as $n=100$ is not a product of two primes, but can be expressed as $100=2^2 5^2$, if valid is there any criteria for choosing $d$ and other values?
2
votes
3answers
688 views

Input limitations on the RC6 cipher

RSA has limitation in input size for encryption and decryption. Can RC6 be used for encryption and decryption of files larger than 5 MB? Is there any limitation for input size? Is RC6 safe for using ...
0
votes
0answers
31 views

RSA: security of LSB in The Generic Model of Computation

In this paper Maurer and Aggarwal showed that in generic model of computation breaking RSA is equivalent to factoring. It is also known that the LSB of an encrypted message is as hard as breaking RSA.(...
6
votes
5answers
1k views

What is the point of digital signatures if confidentiality is violated?

Lets say we use RSA as the signature method. Alice wants to send a message to Bob and uses RSA signing. For that she signs her message with her private key. But everybody could now have access to her ...