Questions tagged [rsa]

An asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption with proper paddings.

Filter by
Sorted by
Tagged with
0
votes
1answer
58 views

Algorithm for factoring a 30 decimal digit number

My professor has given me an RSA factoring problem as an assignment. The given modulus is 30 decimal digits long. I have been searching a lot about factoring algorithms. But it has been quite a ...
4
votes
3answers
659 views

Is there a maximum number of encryptions I should make with the same RSA key?

From an answer to the question RSA maximum bytes to encrypt, comparison to AES in terms of security? I learned that there is a theoretical limit of how much data can be safely encrypted with symmetric ...
1
vote
1answer
48 views

How can I show RSA-OAEP is not IND-CCA secure if G always outputs 0 (i.e. there is no hash function)?

Here is what I understand the algorithm to be: Let $G, H$ be one-way functions, where G outputs the 0 string. ๐ธ๐‘›๐‘๐‘œ๐‘‘๐‘’ Select a random $๐‘˜$-bit integer $๐‘Ÿ$. Pad out $๐‘š$ with $0$s to length $๐‘™...
2
votes
2answers
49 views

How to require two PRIVATE keyholders to decrypt a document?

Consider 3 entities A,B and C. I want A to be able to encrypt a document that can be decrypted only when keys of both B and C are combined. This question talks about a similar problem, but it uses AES....
0
votes
1answer
26 views

Disk storage of RSA and DSA keys

I have generated one RSA-2048 signing key and one DSA-2048 signing key, using gpg command gpg --full-generate-keys I would expect the key to have size 2048 bits, ...
1
vote
0answers
30 views

The following exercise is given in our book and I don't know how to solve it. Could somebody show me how to do it?

$\textbf{13.10 (Probabilistic full domain hash).}$ Consider the following signature scheme $\mathcal{S} = (G,S,V)$ with the message space $\mathcal{M}$, and using a hash function $H: \mathcal{M} \...
1
vote
0answers
23 views

Compared with plain RSA , what is the advantage of randomised public key encryption scheme such as EIGamal encryption?

I am new to cryptography, I am very interested in cryptography, thank you for your answer.
6
votes
2answers
17k views

Finding Private key in RSA with public key, cipher text and plain text

Is there a known 'non-brute force' method of determining a private key in an RSA system when all other parameters are know? I found the values of a ciphertext ($C$), its corresponding plaintext ($P$) ...
1
vote
1answer
45 views

On what basis is padding chosen in OpenSSL?

I am using CAPI Engine in OpenSSL and I did some test. When I use TLS 1.0 or 1.1, during handshake and RSA signing, PKCS padding is chosen. When I use TLS 1.2, RSA signing uses PSS padding. What ...
0
votes
0answers
33 views

Unable to determine plaintext from ciphertext

Given the letter-number cipher: a=00, b=01, c=02, etc., encrypt the word 'hi' and decrypt its ciphertext using RSA. The public key is (5,35) and the private key is (29,35). I know that 'hi' is ...
-4
votes
0answers
51 views

get q from p in rsa [closed]

i want to get q, but i dont know how. Informations: N = ...
2
votes
1answer
90 views

RSA: Construct private / public key for given cipher and plain text message

let's say we are given a classical RSA encryption scheme, though we would like to "reverse" the task: Given two messages $c, m$ choose $p, q, e$ such that $p, q$ are prime and $c ^ d \equiv m\pmod N$ ...
0
votes
1answer
59 views

Message input format for RSA algorithm

I was trying to implement the RSA algorithm myself. I have written the key generation part. My question is if I have the word "apple" which I want to encrypt, do I have to convert each alphabet to ...
0
votes
0answers
24 views

Implementing ESignature and digital certificate

I'm having some issue understanding the mechanism of electronic signature and how implementing it Here what I understood, correct me if I'm wrong: (Client is here an android or ios device. Server ...
1
vote
1answer
82 views

I don't understand RSA encryption (specific questions)?

So I've been studying RSA for a class and I'm having a hard time understanding how it works. Why do we choose the value of e such that e is relatively prime to the totient (as opposed to just being ...
0
votes
0answers
23 views

With node-jose, Should I expect the JWK -> PEM conversion to be reversible?

I am using node-jose to convert a particular JWK to a PEM, and then ... converting that PEM to a JWK. The resulting JWK has the same e, but different n than the original. Should I be surprised? I ...
2
votes
2answers
44 views

Protocol for proof of knowledge of $l$-th root

Assume we have Group G in which the adaptive root assumption holds. This assumption states that if we choose an element $w$ and after that, if we receive a prime value $l$ it is hard to find the $u$ ...
19
votes
2answers
8k views

Is RSA encryption with a private key the same as signature generation?

It is often said that RSA encryption of a cryptographic hash with a private key is the same as signing (signature generation). And that verification consists of decryption using a public key. Is RSA ...
1
vote
1answer
1k views

How to use separate keys for signing and encryption

I read that the same key should not be used for both certificate signing and encryption. I wonder if this is not a problem with PKI/TLS/SSL, the reason being asymmetric encryption is used to transmit ...
1
vote
0answers
52 views

RSA with a prime substituted by a Carmichael number

If the public key in a RSA system is $(n,e)$ with $n=pq$, $p$ prime, $q <p$ a Carmichael number and $\gcd(e,(p-1)(q-1))=1$ then if $d$ is the inverse of $e$ modulo $k=(p-1)(q-1)$, I want to show ...
4
votes
2answers
128 views

Feasible to find two sets with the same RSA accumulator value if a prime representative hash function is used?

Consider the RSA accumulator scheme with random oracle as proposed by Bariฤ‡ and Pfitzmann, with the random oracle replaced by a secure hash function $H$ as follows. For a set $S$, the accumulator ...
1
vote
1answer
56 views

Private exponent on RSA key

this is the first time I write here. I'm studying a library to encrypt/decrypt with RSA algorithm. In an example given by the library I found this: ...
0
votes
0answers
37 views
-1
votes
0answers
23 views

Accidently deleted “~/.gnupg/pubring.kbx” , how to recover keys [migrated]

is there is any way to recover the encryption keys in this case, since they really important 1) the issue: i've lost my gpg key identifiers by deleting ...
0
votes
1answer
67 views

Can there be more than one valid private exponent for a given p, q, and e in RSA encryption?

For example, given: p = 173, q = 149, e = 3 Using phi(n) gives d = 16971 While using lambda(n) gives d = 4243 Both values satisfy the checking equation (de)%phi=1, so are both correct, and if so, ...
0
votes
0answers
25 views

Encrypt and decrypt data accessible by two users on the web on multiple devices

I am currently building a website where a user will be able to upload a file to my server and another user will be able to download the file. Now i want to add encryption to this with the following ...
9
votes
3answers
6k views

Anatomy of an RSA private key

I'm learning about OpenSSL and public key infrastructure and am curious about the structure of an RSA key and how it's related to its corresponding public key. I can generate a private RSA key with ...
0
votes
0answers
28 views

Relation between signature size and message-digest length in RSA PKCS#1v1.5 sign/verify

When using RSA-PKCS#1v1.5 to sign and verify a message-digest, is there a compulsory relation between the sizes of message-digest and the key/signature ? For example, If I use key/signature length of ...
0
votes
1answer
52 views

Relationship between special RSA modulus and quadratic residue in CL (Camenisch-Lysyanskaya) signature

I'm studying the CL(Camenisch-Lysyanskaya) signature (A signature scheme with efficient protocol proposed by Camenisch-Lysyanskaya). However, I cannot understand ...
7
votes
1answer
702 views

Anonymous trust/reputation system

Suppose there are 3 persons, Alice, Bob and Peter. They are identified by their pseudonyms (public RSA keys). Alice has a key Alice, Bob has ...
1
vote
2answers
69 views

Exclusion proof cost

I am trying to understand what is the cost of non-membership verification for a universal accumulator? More specifically, how can I compute it? Whether using an accumulator is more efficient than ...
0
votes
1answer
58 views

Factoring $n$ in RSA knowing $e$ and $d$

I know that if $(n,e)$ is the public key in RSA and we also know $d$ the private key, then there is a probabilistic algorithm to factor $n$. I'm reading the proof from Fact 1 on here. I understand ...
2
votes
1answer
66 views

How to derive a 4096 bit or 8192 bit RSA private key from a (BIP39) mnemonic seed?

How to derive a 4096 bit or 8192 bit RSA private key from a (BIP39) mnemonic seed? Any tool available for this?
2
votes
2answers
71 views

What is blindness and forgeability in chaum blind signature scheme?

I am going through the voting protocols. I know how blind signature works (Blind Signature), but why is blind signature - unconditionally โ€blindโ€, conditionally โ€unforgeable" (as highlighted in the ...
3
votes
1answer
86 views

Constructing an integer with specific totient without factorization

Given $N(=pq)$, but not its factorization. Somehow you manage to know, that $k$ divides $\phi(N)$. Is it possible to come up with an integer $N^{*}$, for which $\phi(N^{*})=\phi(N)/k$, without ...
0
votes
1answer
21 views

Common modulus attack with not coprime exponents

lets suppose we have the public keys $(n,e_1)$ and $(n,e_2)$, such that $\gcd(e_1,e_2)=d>1$, and the same message encrypted with these two keys. I'm trying to see if common modulus attack on RSA ...
1
vote
1answer
35 views

JWE between Android/iPhone and backend

I'm working on a solution where JWE is needed between an Android app and a backend written in Node.JS, using node-jose. I've been struggling a lot since it seems ...
0
votes
1answer
67 views

Prime Factorization in RSA always leads to the product of two primes?

Lets prime factorize $30$: $$30 = 3 \cdot 10 = 3 \cdot 2 \cdot 5$$ We see that the number $30$ is a product of $3$ primes. But in RSA, when factorizing huge numbers, we always seem to only get two ...
0
votes
2answers
65 views

Why is Multiplicative group used in RSA or Euler's theorem but not additive?

I am on the verge to understanding RSA, but suddenly a question popped into mind. When we are calculating $U(N)$ i.e $U(PQ)$, we are taking invertible elements that are co-prime to $N$. For example, $...
0
votes
2answers
64 views

Is HTTPS encryption using the RSA algorithm?

According to this article HTTPS and RSA is the same thing: https://tiptopsecurity.com/how-does-https-work-rsa-encryption-explained/ From other sources I learn that they are both asymmetric encryption ...
0
votes
0answers
66 views

What is meant by the duality and homomorphism of an encryption algorithm?

I am new to the field of cryptography and security so spare me with this question. What is the general idea of duality and homomorphism of an encryption algorithm? And how one may prove those two ...
1
vote
2answers
80 views

What's the actual difference between RSA encrypting and Descrypting and RSA Signing? [duplicate]

this question arised because I'm working with Windows' CNG library and it has 4 functions for RSA: BCryptEncrypt (private key, message) BCryptDecrypt (public key, message) BCryptSignHash (private key,...
1
vote
1answer
63 views

RSA Decryption: Doubts: knowing p or $\phi(n)$ can lead to find private exponent?

I have some doubts about RSA (the public key $n$ and $e$ is public): Note $n = pq$ and $\phi (n) = (p-1)(q-1)$ 1) Say if some hacker knew $p$, why would it be easy for them to find $q, \phi (n), d$? ...
13
votes
3answers
14k views

Is RSASSA-PKCS1-v1_5 a good signature scheme for new systems?

Is RSASSA-PKCS1-v1_5 a good signature scheme to recommend that people use in new systems? Is it believed to be secure and represent the state-of-the-art in RSA-based signatures? I understand that ...
11
votes
1answer
10k views

RSA-PSS salt size

One of the inputs of RSA-PSS signing and verification is the salt size. According to PKCS#1, you must know the salt size before the verification is carried out. However, this makes interoperability ...
0
votes
0answers
35 views

FLT is partly applying to RSA equation, and also relation between ED mod phi and Phi + 1 mod N

After numerous attempts from myself and all of you guys, I finally came to understand RSA. I can now prove it and understand how I got there. But I still have some very few polishing questions. 1) We ...
2
votes
1answer
78 views

Relation between $N = P \times Q$, and $\Phi(N)$

When studying RSA, and proving simple concepts to myself, I went and understood groups and rings, but I failed to understand Lagrange's theorem. I did understand how from invertible finite groups I ...
1
vote
1answer
46 views

Scheme to verify AES key was correctly encrypted for public key recipient

In our file sharing scenario there are three participants: $A$, $B$ and $C$. Each participant has a public-private key pair (let's assume RSA for now). $A$ wants to share a symmetric AES key $k$ with ...
3
votes
2answers
484 views

Distributed integer factorization?

I'm looking around for publicly published work on factorization of large numbers using distributed systems of any kind. So far I've come across the PDF "Mapreduce for integer factorization" by Javier ...
0
votes
1answer
49 views

Combine signature with encryption

I have some embedded device for which I want to sign and encrypt firmware files. Firmware updates are generated by me and may be installed by the customer. The encryption is supposed to protect the ...

1
2 3 4 5
โ€ฆ
41