Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [rsa]

an asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption.

1
vote
1answer
67 views

Hybrid encryption for MQTT payload?

i've written a simple code for payload encryption, i'v done it with AES-128 CBC mode ,it works fine ,the senario is very simple : the publisher send a JSON payload format that includes the encryption ...
10
votes
2answers
376 views

Is this definition of an RSA modulus safe?

Suggested definition A positive integer is a safe RSA modulus if, after removing all its prime factors less than 512 bits, it is composite and has size at least 2048 bits. Discussion I want to ...
6
votes
1answer
2k views

How can I securely encrypt the same message multiple times?

I want to encrypt the same message multiple times. I want to store the encrypted messages together. I've heard if you do this with RSA, an attacker could decrypt the message with the Chinese Remainder ...
2
votes
2answers
92 views

Max size for exponent and modulus in RSA and for y, p, q, g in DSS

I'm writing a method in Java to read SSH public key in RFC 4253 format, which, in my case, can be either RSA, or DSS. What I really need is to read exponent and <...
2
votes
2answers
178 views

Why PS does differ between PKCS1 v1.5 padding for signature and for encryption?

As you may know, PKCS#1 defines two different padding in it's v1.5 : one for signature and one for encryption. Here they are : The middle part is refered as PS in the standard. There is only one ...
2
votes
1answer
52 views

The “openssl genrsa” command only generates a private key?

The command : openssl genrsa -out RootCA.key 4096 generates a single file named RootCA.key. When I open the file, it only contains the private key. Then ...
8
votes
2answers
396 views

Is Bouncycastle RSA+OAEP implementation vulnerable to Manger’s attack?

I have written a code to encrypt a plaintext as below. Here I am using bouncycastle crypto provider and referring to the RSA+OAEP for that. ...
1
vote
0answers
28 views

Verifying dealer parameters in 1-2 oblivious transfer

I read the description of 1-2 oblivious transfer algorithm in wikipedia. In the algorithm described Alice has two messages $m_0, m_1$. Bob picks value $b \in {0,1}$, and the protocol allows Bob to ...
1
vote
1answer
209 views

How can I implement ID based encryption using RSA?

I want to implement ID based encryption using the RSA encryption algorithm but how can I edit the algorithm for IDs.
1
vote
1answer
216 views

RSA: How to get ciphertext in decimal from an encrypted base64? [closed]

I was given the ciphertext as base64 just like that: ...
2
votes
0answers
25 views

What are SNFS-safe limits for an RSA moduli optimized for simple modular reduction?

I consider $n$-bit RSA moduli $N$ having high-order bits starting by with $k$ bits at 1, then $k$ bits at 0, then $m-2k$ bits at ...
1
vote
0answers
72 views

Where shoul I store private/public keys and how should I share it?

I'm new in terms of encryption and I have to encrypt the data between two Java Spring applications, one have serves as MVC framework and other as Web Service, I'm implementing an asymmetric encryption ...
-1
votes
1answer
38 views

I am new to digital certificate 509V3 concept. can some one please clarify the below points [closed]

I am using RSA 2048 with SHA 256 primitive in certificate: How to verify the user certificate n + 1 with Root certificate n? why it is required to perform Certificate chain verification? How to ...
0
votes
1answer
67 views

How to find p,q in this problem?

Suppose \begin{align*} g^r &\equiv h \pmod N, \\ h^s &\equiv g \pmod N, \end{align*} for known $g$, $h$, $r$, $s$, and $N$, but not $\phi(N)$. Then $$g^{r\cdot s - 1} \equiv 1 \pmod N,$$...
0
votes
1answer
237 views

Decode & Verify Base64urlUInt-encoded RS256 Public Key from Google

According to Google, to access the id_token it sends along with Access Tokens (for accessing their API), you must first validate the token using the RS256 Public Key available from this page. The ...
1
vote
0answers
26 views

GPG encrypt performance degradence for thousands receipients

I plan to use GPG to encrypt a small file (32KB) for very many recipient public keys (few thousands). I tested GPG with RSA and then ECDH public key encryptions. If RSA is very slow, with ECDH (nist ...
0
votes
1answer
110 views

Which algorithm should be used to replace SHA512withRSA? [closed]

We are working on the web application that is basically generating a self-signed certificate during the installation. It's a Java based app and for generation of the certificate we are using ...
0
votes
2answers
106 views

What kind of RSA is this?

I'm currently trying to write a server emulator for a multiplayer game. I've found what I believe to be the RSA keys. I've found that by editing them I can get the real login server to reject them ...
0
votes
2answers
116 views

RSA: finding e given n, m and c

So I'm not sure if this is possible but assume I have $$c \equiv m^e \pmod n$$ I have $c$, $m$ and $n$ but no $e$, which in my case I a value that can be up to 15 digits. Is there a way to do this?
2
votes
3answers
89 views

Difficulty deciphering the RSA algorithm

$d = 27, e = 3, n = 40$ For encryption, I have the letter T converted to 084 by the ASCII table, which encrypts to $24$ by $84^...
17
votes
3answers
7k views

After Google's collision attack, is RSA-SHA1 signature still safe?

Google succeeded to get a collision in SHA-1 last year in an attack called shattered. Does this fact make certificates based RSA-SHA1 Signature risky for creating fraud certificates? If RSA-SHA1 ...
2
votes
1answer
134 views

Finding missing bits mathematicaly in a DLP situation (full problem)

In a preparatory question we had to recover decimal digits $@$ of $r$ and $s$ given $g=51234$, $h=90403$, $N=111649$, $r=3@497$, $s=276@3$, with $r$ and $s$ the smallest positive solutions to $g^r\...
1
vote
1answer
46 views

Verification in Threshold RSA or Threshold Paillier

In the key generation of the threshold version of RSA or the threshold version of the Paillier cryptosystem (e.g. "Shoup - 2000 - Practical threshold signatures" or "Fouque et al. - 2000 - Sharing ...
3
votes
1answer
85 views

Ciphertext size of RSA, ELGamal, and EICES encryption

I have to make a choice based on the minimum stored data, so I would like to know which encryption protocol is better in terms of the size of the resulting ciphertext for very short plaintexts (8 to ...
0
votes
1answer
40 views

RSA-FDH and random oracle query count

I am now reading a paper 'The Exact Security of Digital Signatures - How to Sign with RSA and Rabin' and there is an equation e = (q_sig + q_hash) * e' on page 401. (e : success probability of RSA, e' ...
0
votes
1answer
123 views

Is this RSA / SRA cipher modification secure?

I have modified SRA algorithm to suit my problem and I'm wondering if it is still safe to use. Main question is if RSA Encryption key that contains even number is a safe one way function? In RSA ...
1
vote
1answer
128 views

How fast a middle-class computer can verify assymetric signatures (like ECDSA, RSA etc.)?

I have an idea for a peer-to-peer network that will require every connected peer to verify many symmetric signatures per second. In bitcoin, it's the same - every peer independently verifies ...
2
votes
1answer
140 views

RSA padding and Least Significat Bit Oracle Attack

So my question is do padding schemes used in RSA protect it against Least Significant Bit Oracle attack? The attack I am talking about is described here: RSA least significant bit oracle attack As ...
6
votes
1answer
358 views

What is the reason for length differences in RSA?

In NIST FIPS 186-4, "digital signature algorithm", the minimal length allowed is 1024 bit (page 22). On the contrary, in NIST SP800-56B, page 63, RSA-OAEP encryption, the minimal length is 2048. Why ...
3
votes
1answer
113 views

Why ISO/IEC 9796 (signature with message recovery) instead of just encrypt the short message with private key?

I've had a look at “Practical Cryptanalysis of ISO/IEC 9796-2 and EMV Signatures” and read the very good answer https://crypto.stackexchange.com/a/17846/59673 and I understand that signature and ...
1
vote
2answers
105 views

Who calculates the private exponent $d$ in RSA?

Who calculates the private exponent $d$ in RSA? Only $(n, e)$ are public and to calculate $d$ (with $d$ being the multiplicative inverse of $e$ with respect to $\phi(n)$), the receiver need $\phi(n)$. ...
0
votes
1answer
63 views

question about RSA sign/verify scheme

could you please explain what is the problem here?: I'm trying to simulate sign/verify scenario with RSA keys. For simplicity I use 64bits keys: ...
14
votes
2answers
473 views

RSA factorization for special primes $p$ and $q$

I want to factorize the modulus $n = pq$ knowing that $p$ and $q$ are not random, but constructed based on integer numbers $a$ and $b$ as following ($a$ and $b$ are not given): $$p = a^2 + b^2, \...
1
vote
2answers
68 views

Derandomized version of RSA-OAEP

We know a standard way (cf. RFC 6979) to derandomize ECDSA signatures, i.e., to generate ECDSA signature without an external source of randomness. Is there any similar standard way, or academic-...
34
votes
3answers
5k views

What is bignum-free RSA?

I recently saw a claim that BearSSL has a bignum-free implementation of RSA. What does this mean? I don't see how one could implement RSA without bignum arithmetic.
1
vote
0answers
61 views

Implementing Boneh & Durfee attack on RSA with low private exponent

I am trying to understand various attacks on RSA and I believe that the only way to fully understand an algorithm is to implement it. I am trying to implement the code in this paper: Dan Boneh and ...
6
votes
2answers
910 views

Largest integer factored by Shor's algorithm?

I'm studying Shor's quantum factoring algorithm. I was wondering what the largest integer is which they were able to factor with a small quantum computer. Does anybody has an idea about this?
0
votes
1answer
104 views

Go: Should I use secretbox or RSA?

I want to encrypt a file with a RSA public key. I generate a random 16 bytes key I encrypt the file with AES + the random key (aes.NewCipher() + ...
0
votes
0answers
70 views

Avalanche effect in RSA

I couldn't understand the avalanche effect in RSA. Could someone explain how avalanche effect happens in RSA?
3
votes
2answers
255 views

Generating secure short activation code for offline applications

My application is as follows User has a hardware system (with an unique ID) that does not have connectivity but has a keypad for input. To make the hardware operational, the user has to go to central ...
0
votes
0answers
53 views

Why Diaspora Federation pod communication protocol shares AES keys over asymmetric encrypted channels?

As I was looking over the diaspora federation Magic Envelope documentation, I noticed something weird: { "aes_key": "...", "encrypted_magic_envelope": "..." } ...
16
votes
5answers
3k views

Is there a situation where RSA cannot be replaced with ECC + symmetric algorithms? If no, why do we still use it?

RSA is both an asymmetric encryption algorithm and a digital signature algorithm. However, in recent years, many cryptographic protocols (TLS, for example) have moved away from the use of RSA to ...
6
votes
2answers
296 views

Why is pqRSA in the NIST PQC submissions?

In the NIST post-quantum cryptography workshop, the round one submissions included pqRSA. If memory serves, this is an implementation of RSA using the product of a very large number of 4096-bit primes ...
3
votes
1answer
135 views

RSA hybrid decryption via PKCS#11 - unwrap or decrypt?

I have an application that does RSA hybrid encryption/decryption – i.e., messages are encrypted with a fresh AES key, which is then itself encrypted with RSA-OAEP and sent with the message. Decryption ...
4
votes
2answers
162 views

How ROCA get the polynomial used with coppersmith

I'm trying to understand the ROCA attack on RSA from Matus Nemec et al. but I'm stuck on how they goes from the constraint they have expressed has: $$f(x) = x ∗ M' + (65537^{a'} \mod M') \pmod p$$ To ...
1
vote
2answers
136 views

Could RSA keypairs be used for cryptocurrency addresses?

A bitcoin address is created from an ECDSA keypair. It is common to use use a hashed version of the public key as the shared address, but the original bitcoin implementation also allowed for using the ...
1
vote
2answers
62 views

Let $ALG_2$ be an algorithm that solves the RSA problem, can it solve the generalized Diffie-Hellman problem?

Let $ALG_2$ be an algorithm that solves the RSA problem for all $e\in \mathbb{Z}_n^*$ i.e given $e,m^e,n$ then $ALG_2(e,m^e,n)=m$. Is it possible to use this algorithm to solve the generalized Diffie-...
0
votes
0answers
170 views

RSA: Multiple Private keys for single public key and N

I'm working on a problem that gives me two private keys $d_1,d_2$ that work with the same $(N,e)$ pair. The problem gives me the two private keys and $N$. Is it possible to find $p$ and $q$? Or how ...
2
votes
1answer
87 views

Side-Channel attack on RSA decryption using comparison result with p,q?

I was pointed to whether we could learn the secret key of RSA by repeatedly using following side channel: We assume that there exists a side channel in RSA decryption using CRT that, if the most-...
1
vote
0answers
51 views

Why only ABE is used in ABAC

Why ABAC access control model uses ABE not RSA or any other public key cryptography? Moreover what is the relation of ABAC with public key cryptography (ABE/RSA)?