We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [rsa]

an asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption.

Filter by
Sorted by
Tagged with
3
votes
2answers
5k views

Chosen plaintext attack on textbook RSA decryption

Let $(n,d)$ be an RSA private key and $(n,e)$ the corresponding public key. Generate a secret random $r$ from $(\mathbb{Z}/n\mathbb{Z})^*$ Compute $C’ = C (r^e) \bmod n$ Submit $C’$ as a chosen ...
2
votes
2answers
4k views

RSA PCKS1 v2.1 RSAES-OAEP algorithm

Using RSA public key (n,e) the encryption of a message is c= (m^e) mod n and the corresponding message is decrypted as ...
2
votes
1answer
256 views

RSA private exponent primality

I know that the public exponent is always a prime, but what about the private exponent? Is it always a prime too?
2
votes
2answers
737 views

Can you recognize a low private exponent from a public key?

In the RSA cryptosystem, Wiener, Boneh and Durfee showed that low private exponents can be efficiently recovered. Is it possible to see from a public key alone whether the private exponent (d) is ...
2
votes
1answer
2k views

How does OAEP improve the security of RSA?

The heart of OAEP algorithm used for RSA encryption are the cryptographic hash functions $H$ and $G$. Does everybody (so also an adversary) know these functions? If YES: How does it help the ...
2
votes
1answer
988 views

Main purpose for Carmichael's Function in RSA

I'm trying to understand the RSA cryptosystem, these are the steps: Generate two large different prime numbers $p$ and $q$. Calculate modulus $n$ ($n=pq$) Calculate: $λ(n) = \operatorname{lcm}(λ(p), ...
2
votes
2answers
669 views

RSA keys finding when messages are known

I have this situation, where, in a game, people send messages to each other (game moves etc...) These messages need to be encrypted, and should only be readable by the destination person. I am using ...
2
votes
2answers
29k views

How do I calculate the private key in RSA?

Given $n=pq$ for $p,q$ known, I can calculate $\phi(n)$. $e$ is selected such that $\gcd (e,\phi(n)) = 1$. Using this, how do I calculate the RSA private key? Example: I have $n = 35$, with $(p,...
2
votes
2answers
4k views

What will happen if I use RSA encryption for plaintext larger than RSA bit size?

I have often read that using RSA for encrypting bigger size plaintext is not good solution. What I understand is that using RSA encrytion is best for small plaintext and most effective if it is ...
2
votes
4answers
2k views

Does it make sense to have a 4000 bit long key?

My question is about the key length of a asymetric algorithm. How is it possible to memorize or remember a key that is about 4000 bits long?
2
votes
3answers
2k views

RSA finding the inverse of the public exponent

I have a very basic doubt in RSA key generation and its usage. In RSA key generation you choose two large prime numbers of a very large order. Then you multiply them.(eq $p \cdot q = N$) Now, $\phi(N)...
2
votes
1answer
2k views

Exactly how slow is asymmetric encryption?

I'm currently doing a project on RSA, and have just come across this website. https://www.namecheap.com/support/knowledgebase/article.aspx/798/67/what-is-an-rsa-key-used-for On here, it says that ...
2
votes
1answer
1k views

How do we arrive to the equation for solving D in RSA?

We have been shown that DE is congruent to 1 mod phi(n). How do we arrive to the real equation for figuring out d that is d = e^-1 mod phi(n). I want to know the entire process. I am just curious, ...
1
vote
2answers
2k views

What is the difference between RSASSA-PSS signing and RSA-PSS signing?

I read the RFC 8017 and understood the pkcsv1.5 and pss padding techniques. I understood that in RSASSA-PSS signing scheme the signature will be appended at the end of M. In some websites I read both ...
1
vote
1answer
474 views

In RSA, why does Alice's $N$ need to be relatively prime to Bob's $N$?

I was asked this by my professor and I didn't understand the reasoning behind it. If Alice has a the key pair $(p_a, n_a)$ and Bob has the key pair $(p_b, n_b)$, why do $n_a$ and $n_b$ have to be ...
1
vote
2answers
771 views

RSA signature signing

For assymetric encryption such as RSA, I understand that Alice can sign a document with her secret key and send it to Bob, which he can then verify. Sign: $\sigma=m^d \bmod N$ Verify: $v=\sigma^e \...
1
vote
2answers
635 views

Is this RSA signing and verification process secure?

I need to verify that messages in a communications program are from valid senders. Below is a highlevel outline of how I think the process would work. The connections themselves are done over TLS. The ...
1
vote
1answer
188 views

Primality test in GPG/RSA or extract numbers of private key

I cannot find if the two numbers for RSA are tested against an elliptic curve primality test. If not, is there a way to extract the two integers of my private key in order to test it by myself? If ...
1
vote
0answers
86 views

RSA low exponent with padded plain-text

Considering a case, when modulus is large and hard to factor, exponent e=3 and there is a cipher-text which is created by padding plain-text with ...
1
vote
1answer
76 views

Picking 'e' for RSA encryption

What is the reason behind picking either $3$ or $2^{16}+1$ for generating the public key in RSA?
0
votes
1answer
700 views

1024 RSA Hash Signature attack. Forge a valid signature

I have an RSA signature of 1024 bit where i know the following: Public modulus N Public exponent (0x03) Cypher message Summary: An MD5 hash is calculated from a collection of byte and is used as ...
0
votes
2answers
170 views

How to sign with RSA safely?

what should I do to make my RSA signatures secure? If "plaintext RSA" is not secure, is there some sort of "RSA on steroids" I am not aware of? Could anybody tell me what is it? I read a Wikipedia ...
0
votes
1answer
219 views

In RSA, given $n=100$ and $e=13$ ,Encrypt and Decrypt the plain Text “SECRET”

Is this question valid as $n=100$ is not a product of two primes, but can be expressed as $100=2^2 5^2$, if valid is there any criteria for choosing $d$ and other values?
0
votes
1answer
1k views

What's the best way to pad a message?

Currently my padding is adding a string of random characters $ l(N)/3 - (l(M) + 1) $ Long and just adding it to the messages, is this sufficient? $l(x)$ = length of a variable
-1
votes
1answer
48 views

RSA limiting down the possible values for $n,q$, and $d$? given only $e$ and $p$ [duplicate]

Suppose someone forgot the value of $n$ and you only knew the values for $e$ and $p$. How could one go about limiting down the possible values for $n,q$, and $d$? I'm thinking to try and solve $\gcd(...
-3
votes
1answer
3k views

Why plain RSA encryption does not achieve CPA-security?

Why plain RSA encryption does not achieve CPA-security?
9
votes
2answers
2k views

How does PKCS 1.5 solve the insecureness of Textbook RSA?

As we know, Textbook RSA is not enough safe to use because of the following issues; Guessable plaintext problem Small $e$ issue I want to know how PKCS 1.5 solved these problems.
9
votes
2answers
2k views

When/why is RSA (hybrid) encryption used rather than alternatives?

I've read that RSA is not meant for encrypting large plaintext because: (Are these also true for other public-key encryptions like ElGamal?) It is slow. Padding makes the ciphertext blocks much ...
9
votes
1answer
614 views

why did oaep change from pkcs1 v2.0 and v2.1?

In PKCS1 v2.1 the OAEP output is prepending with a null byte. Quoting RFC3447, ...
9
votes
2answers
3k views

RSA-based authentication and key-agreement protocol

An authentication and key-agreement protocol between devices shall mutually demonstrate their identity, and establish a shared random secret $R$ suitable for securing later communications. To that ...
8
votes
1answer
484 views

Why Static RSA and Diffie-Hellman cipher suites have been removed in TLS 1.3?

Why Static RSA and Diffie-Hellman cipher suites have been removed in TLS 1.3? How keys can be exchanged then? https://tools.ietf.org/html/draft-ietf-tls-tls13-28
8
votes
1answer
336 views

Can RSA be securely used for “blind decryption”?

Assume we have the following setup: A client with trusted storage and computing capabilities (e.g. a smartcard) A server with trusted computing and short-term storage capabilities (e.g. RAM + CPU, ...
7
votes
2answers
719 views

Given enough RSA ciphertext, is it possible to determine which key was used?

Given enough RSA ciphertext, is it possible to determine which public key was used to generate the ciphertext? Presume an unknown public key that was used to generate RSA ciphertext, and we have ...
6
votes
3answers
324 views

Is there an upper bound to the private exponent in RSA?

In the RSA algorithm, we choose $p$ and $q$ as prime numbers and we select a value $e$ which is coprime to $\varphi(pq)=(p-1)(q-1)$. Then we calculate $d:=e^{-1}\bmod\varphi(pq)$. My question is: ...
6
votes
1answer
4k views

RSA Digital Signature vs Elgamal Digital Signature

What are the advantages of RSA signatures against ElGamal signatures? Is there a situation in which it would be better e.g. to use RSA signatures?
6
votes
2answers
6k views

Is RSA-OAEP deprecated?

I need asymmetric pub/private keypair encryption in JavaScript. Web browsers support RSA-OAEP, which works exactly as I need. But there is a table which lists supported algorithms for web crypto at ...
5
votes
1answer
288 views

low-exponent RSA

I have questions from http://link.springer.com/chapter/10.1007%2F3-540-68339-9_1 Suppose we have 2 messages $m_1$ and $m_2$ related by a known relation $m_2=m_1+1$. Suppose further the messages are ...
5
votes
1answer
4k views

Are there comprehensive alternatives to RSA?

If we wished to, is there a comprehensive alternative to RSA? I say comprehensive as I wonder if there is one which does both encryption and digital signature like RSA? If not, simply what ...
5
votes
5answers
601 views

Is there a technique to confirm that a given large integer value is a product of two primes?

Given a list of 2048 bit integer values in which one or few 2048 bit integer values may be product of two prime numbers and other values may be just 2048 bit odd integers numbers. My question is - ...
5
votes
1answer
15k views

RSA 4096 bit key benchmark

How can I benchmark RSA operations on my computer? I want to know about 4096-bit long keys on general computers. How many encryptions and decryptions are possible per second? All benchmarks I found ...
4
votes
3answers
558 views

Deduce modulus N from public exponent and encrypted data

This is an RSA question, given data encrypted with a public key from an unknown RSA certificate of 2048 bit, let $X$ be the encrypted data, $M$ the unencrypted data, $c$ the public exponent and $N$ it'...
4
votes
1answer
653 views

RSA time function

I am doing a paper on textbook RSA (highschool-level). I am explaining and proving the significance of the public key exponent in time and security. So far, I have encrypted a constant message with a ...
4
votes
1answer
11k views

RSA PKCS#1, v1.5 padding output

If I make use of RSA PKCS#1 in v1.5 what padding length is used. Basically, it is not allowed that the plaintext is bigger than the modulus. But what if the length in bits is the same (padding to ...
4
votes
1answer
510 views

RSA 1024 bit forge a new matching signature from a chosen message

I have an RSA signature scheme with 1024-bit key where I know the following: Public modulus $N$ Public exponent $e=3$ A lot of signatures Summary: To compute a signature, an MD5 hash is calculated ...
4
votes
2answers
419 views

For RSA keys, is the safety of a given key-length different for signing vs encryption?

I'm wondering if considerations of key-length are different when thinking about signing vs encryption. If for some reason, it was safter to use smaller keys for signing that would be interesting.
4
votes
2answers
600 views

Is it hypocritical to use AES-256 and RSA 2048 in the same application?

I see a common claim that AES-256 is the gold standard and is good future proofing, often in the same wind as "just use 2048-bit keys for RSA". Security documents seem to recommend both AES-256 and ...
4
votes
2answers
636 views

In RSA $(e,n)$, $(d,p,q)$, why does it work even if plaintext $M$ is not coprime with $n$?

I read this post Does RSA work for any message M?, but I cant prove that $(M^e)^d-M\equiv 0\pmod{p}$ like this:
4
votes
2answers
3k views

Certificate Authority RSA key expiration?

My understanding about SSL/TLS for HTTPS is that servers send their certificates to browsers and browser attempt to decrypt them using trusted CA public keys that are already presented in their store. ...
4
votes
3answers
301 views

Why are we not using multiple ciphers per message?

I am aware of at least rsa, elgamal-encryption, and variations of elliptic-curves relying on different problems and that those problems are considered hard. However, if someone figures out a way to ...
3
votes
2answers
3k views

RSA: Is it secure to use the private key to encrypt and the public key to decrypt?

This may sound weird: What if I don't let others know my public key, then use my private key to encrypt, and the public key to decrypt? Is this secure? Let me explain a little bit: Common usuage: use ...