The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [rsa]

an asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption.

Filter by
Sorted by
Tagged with
-1
votes
0answers
14 views

RSA given p,q,n,c1,c2,e1,e2

I am given the p,q,n,c1,c2,e1,e2 values for an RSA key, along with an encrypted message. Here are those values: ...
0
votes
0answers
29 views

What Chaining Mode to use with RSA? (CNG's BCrypt)

I'm trying to make my first RSA encryption/decryption using CNG. In 1 part of the example they add pick a chaining mode, I don't know if this is mandatory and when I tried to google about it I found ...
1
vote
1answer
66 views

Probabilistic verification of signature schemes like RSA?

I was wondering if there were any verification algorithm in the literature that enables a "probabilistic" verification of well-known signature schemes? For RSA signature verification for example, is ...
8
votes
1answer
442 views

Why Static RSA and Diffie-Hellman cipher suites have been removed in TLS 1.3?

Why Static RSA and Diffie-Hellman cipher suites have been removed in TLS 1.3? How keys can be exchanged then? https://tools.ietf.org/html/draft-ietf-tls-tls13-28
0
votes
1answer
27 views

Combine signature with encryption

I have some embedded device for which I want to sign and encrypt firmware files. Firmware updates are generated by me and may be installed by the customer. The encryption is supposed to protect the ...
2
votes
1answer
198 views

Decrypting Multi-Prime RSA with e, N, and factors of N given

I was wondering if there was any way to compute the private key $d$ when knowing only $e$ and $N$, and being able to factor $N$ as 4 prime numbers $p, q, r$ and $s$. I've been searching for days and I ...
1
vote
1answer
85 views

Why does RSA need two prime numbers?

I'm having a hard time understanding the purpose of having two primes $p,q$ for RSA to work. To illustrate my point, imagine only one prime ($p$) is used. Alice, the encryptor, can take the public ...
0
votes
0answers
26 views

There are 3 factors in RSA [duplicate]

A Variant RSA. $n$ has 3 factors $p,q,r$. $\gcd(e,\phi(n))=1$, can decrypt it like normal RSA,or should use chinese remainder theory to decrypt it?
4
votes
1answer
182 views

When is factoring semi-primes thought to be hard?

In Lattice Cryptography, problems like LWE or SIS have relatively easy to specify distributions that are thought to be average case hard. I'm curious what specific distributions on semi-primes $(p,q)$ ...
9
votes
2answers
2k views

When/why is RSA (hybrid) encryption used rather than alternatives?

I've read that RSA is not meant for encrypting large plaintext because: (Are these also true for other public-key encryptions like ElGamal?) It is slow. Padding makes the ciphertext blocks much ...
0
votes
0answers
5 views

Sign Verify problem by provider in JCA [migrated]

I'm trying to sign and verify my data with SHA256withRSA,MD2withRSA,SHA1withRSA,SHA512withRSA modes. My provider supports all of them but, just MD2 mode works for my code. Other ones does not work, ...
2
votes
1answer
124 views

Man-in-the-middle attack on text-book RSA PKE

I am attempting to solve the following problem: I know the following: 3 messages are being sent between Alice and Bob, all messages are encrypted with the known public key $(d,N)$: Alice sends ...
-1
votes
0answers
57 views

In RSA, how do you find d with a very large e?

If I had N and E, how would I be able to find D? The catch here is E is extremely large -> like 310 digits. I think this set of numbers is vunerable because E should be relatively small. How can I ...
2
votes
0answers
322 views

Attacks on RSA with partially known plaintext

I know modulus $N$, public exponent $e$ and have some crypted messages $c_i$, $c_i = m_i^e mod N$. I know something about each $m_i$: they have a sequence of bytes BAADF00D at offset $t$. Is there ...
3
votes
1answer
200 views

Inclusion and Exclusion proofs in RSA accumulators

I am reading about RSA accumulators from this video and few other sources. I had a confusion whether the complete set is needed to construct a proof of inclusion/exclusion in an RSA accumulator or is ...
7
votes
2answers
598 views

RSA Timing Attack on “Extra” Montgomery Reduction

In "A practical implementation of the timing attack", the authors take advantage of a timing difference that stems from "extra reductions" that occur when multiplying numbers in the Montgomery form. ...
0
votes
1answer
31 views

RSA PKCS#1 v.15 Signature verification computational complexity explanation? [duplicate]

I've been experimenting with MBEDTLS on an ARM-M4 (but this question is not platform-specific) and am confused/surprised regarding the computational complexity (execution time) of ...
3
votes
2answers
22k views

Decrypt digital signature using RSA public key with openssl

I have a digital signature that was created using the following algorithm: a SHA-256 hash of the body of the message is calculated. It is then signed using an RSA private key and the result is base64-...
11
votes
3answers
8k views

What are some disadvantages of homomorphic encryption schemes?

I'm doing some self-teaching / research for my own benefit in homomorphic cryptography. I've studied both additive and multiplicative schemes (Paillier and RSA respectively), but all I can seem to ...
0
votes
1answer
62 views

Using an integer ring with RSA

I'm new to RSA and instead of using RSA to encrypt a symmetric encryption key to encrypt data with (although it might help to understand) I would like to use an integer ring with RSA. My question is ...
19
votes
1answer
8k views

What is the history of recommended RSA key sizes?

One can find up to date recommended key sizes for RSA at NIST sp800-131A for example. In short, it suggests a key size of at least 2048 bits. Is it possible to find a history of recommended key sizes ...
16
votes
4answers
17k views

What is the relation between RSA & Fermat's little theorem?

I came across this while refreshing my cryptography brain cells. From the RSA algorithm I understand that it somehow depends on the fact that, given a large number (A) it is computationally ...
11
votes
3answers
13k views

Why can’t DSA be used for encryption?

This question at StackOverflow mentions that DSA cannot be used for encryption. But both RSA and DSA can be used to generate public and private keys, right? Then why can't I use the DSA public key to ...
0
votes
4answers
241 views

Why is RSA secure if I can solve the equations for it using a math solver?

To factorize N = p * q with p < q e (p-2) mod 9 = 0, there are a set of equations. These equations can be put into any popular math solver, in order to gain access to the primes p and q. For ...
4
votes
2answers
510 views

It is reasonably safe to leave an AES encrypted RSA private key public?

The owner of the RSA key can't store the key, so they need to hand the key to an untrusted entity for storage. Before they hand it over they encrypt it using AES with a multi-word phrase they can ...
3
votes
2answers
113 views

Why is RSA encryption performed in mod n, but computation of inverse in $\bmod \varphi(n)$

I am studying the principles of RSA and have come across some unintuitive statements. Lets revisit the RSA algorithm: RSA Key Generation Output: public key: $k_{pub} = (n,e)$ and private key: $k_{pr}...
2
votes
2answers
340 views

What is the efficiency of the new Crown Sterling semiprime factoring method?

In their press release a company called Crown Sterling describes they are working a paper that includes four different geometric and arithmetic methods for public key (semiprime) factorization and ...
0
votes
1answer
91 views

How you find the unpadded short plaintext using RSA?

I am currently trying to understand how you find the unpadded short plaintext when you are using RSA. Please help with explaining the process and so I can understand this topic more.
2
votes
1answer
507 views

How many bits to flip in an RSA public key to do signature forgery?

Scenario: Alice wants to verify a signature from Bob. Alice knows Bob's RSA public key (e, n). However, Alice is getting the data, the signature of the data and the public key from an attacker Eve. ...
6
votes
1answer
423 views

RSA PSS security advantage

To my humble opinion, please correct me if I'm wrong, RSA-PSS (PKCS#1 ver 2.1) advantage over RSA as described in PKCS#1 ver. 1.5 is in its security proofs. Does this proof and the advantage is still ...
10
votes
4answers
6k views

Encrypting small values with RSA private key

I'm looking for best practices when it comes to encrypting small (< 128 bytes) amounts of data with the RSA private key. Signing it would make the resulting payload too large.
1
vote
0answers
286 views

RSA Signature Forgery

We all know that x509 certificates carry a signature that represents the certificate digest encrypted by the private key of the issuer. I believe that the digest is encrypted only providing one block,...
11
votes
1answer
9k views

RSA-PSS salt size

One of the inputs of RSA-PSS signing and verification is the salt size. According to PKCS#1, you must know the salt size before the verfication is carried out. However, this makes interoperability ...
7
votes
1answer
674 views

Anonymous trust/reputation system

Suppose there are 3 persons, Alice, Bob and Peter. They are identified by their pseudonyms (public RSA keys). Alice has a key Alice, Bob has ...
2
votes
1answer
124 views

Establish Trust By Signing Random Seed

I'm trying to get my server to establish trust with a client. Neither is on the Internet, so there are no certificate authorities. The typical way to establish trust in my domain is for a client to "...
2
votes
1answer
406 views

AEAD: Is it secure to decrypt the content encryption key before verifying the MAC?

The JSON Web Encryption (JWE) standard defines a number of encryption modes with the same basic form: First, the a unique content encryption key (CEK) is generated and used to encrypt the payload ...
3
votes
1answer
95 views

Providing forward secrecy with RSA

Forward secrecy with RSA is asked here: Is perfect-forward secrecy achieved with RSA? and fgrieu gave an answer based on creating temporary RSA keys and signing them. And, in the end, he mentions ...
1
vote
0answers
43 views

RSA congruence (n is not given) [closed]

it might be a silly question but i need help please given RSA system , where $n=pq , p\ and \ q \ are \ primes $ , $ v_0,v_1,v_2, v_3 \ are \ known $ $p^p \equiv v_0 \mod q$ $q^q \equiv v_1 ...
2
votes
1answer
104 views

Using YubiKey to store a PIN-protected secret for disk encryption

I want to store a secret on YubiKey and use it for disk encryption. It's crucial that it be PIN protected. There are a limited number of PIN tries, and after three attempts the YubiKey would be ...
3
votes
1answer
3k views

MiTM on RSA public key encryption

a) Alice just generated a new pair of public and private RSA keys (pkA , skA ) = ((N, e), d) and would like to start a private conversation with Bob. How can Alice interact with Bob and exchange a ...
1
vote
2answers
22k views

RSA given q, p and e? [closed]

I am given the q, p, and e values for an RSA key, along with an encrypted message. Here are ...
5
votes
2answers
3k views

Proof for exponentiation in modular arithemtic

If $e$ is a natural number, then this is true: $$m^e \bmod\ n = (m\bmod\ n)^e\bmod\ n$$ This is often used when encrypting, especially with RSA, since one can avoid directly calculating $m^e$, ...
14
votes
2answers
7k views

Is perfect-forward secrecy achieved with RSA?

I am new to cryptography and am going through the book Understanding Cryptography by Paar and Pelzl. From what I understand Symmetric key distribution systems like Kerberos do not provide PFS ...
1
vote
1answer
82 views

Calculate d for RSA

I'm trying to calculate $d$. I have the following parameters given: $p = 239$ $q = 181$ $n = p \times q = 43259$ $\phi(n) = (p - 1) \times (q - 1) = 42840$ $e = 11$ For calculating $d$ I use the ...
0
votes
1answer
40 views

Optimising shor's algorithm [closed]

So I've run into this challenge where I was given the guess $g$, and the power $p$ of Shor's algorithm. All I have to do now is $g^{p/2} - 1$ and then GCD the result with n. But the problem is ...
0
votes
0answers
12 views

Why does mbedtls_rsa_rsaes_pkcs1_v15_encrypt() to make wrong encryption? [migrated]

I use mbedtls library for my small crypto application. mbedtls API has this function: ...
6
votes
1answer
2k views

Can you help me understand the Common Modulus Attack in a Lucas Group? [closed]

I'm trying to decrypt a message that is encrypted using a LUC encryption scheme and running into roadblocks. I know that with RSA if Alice and Bob use the same public modulus but different encryption ...
2
votes
4answers
3k views

What is k in RSA?

I am currently learning about RSA since I didn't understand the public-key-system but now I am… kind of. So I am writing the numbers as follows: $p = prime\ number\\ q = prime\ number\\ N = Public\...
1
vote
2answers
76 views

Hybrid cryptosystem

I'm using RSA (4096) and AES GCM (256) to exchange messages between A and B. A random key for AES is generated, the plain message is encrypted with AES, and the random AES key is encrypted with Bs ...
1
vote
2answers
49 views

RSA-CRT exponent reduction

In the implementation of RSA-CRT, the exponent d is reduced mod p-1 ($d_p = d \bmod {(p-1)}$). The only proof I've found for that, is the following (considering $d = k\varphi(p) + d \bmod {\varphi(p)}$...