Questions tagged [rsa]

an asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption.

Filter by
Sorted by
Tagged with
3
votes
1answer
898 views

For RSA, is there a specified size range for $p$ and $q$ when calculating $N$?

Is there a specified size range for $p$ and $q$ when calculating $N$? For example, what size would $p$ and $q$ be when $N$ is 1024 bits?
3
votes
1answer
120 views

Authenticate encrypted seed for KEM + AEAD hybrid cryptosystem

Say I want to encrypt something using RSA / KEM and an authenticated cipher. I encrypt using the following scheme: generate random seed z using ...
3
votes
2answers
1k views

Why is the following RSA PRNG cryptographically secure?

One requirement states that the generator has to withstand the next-bit test. Consider the following PRNG, where we calculate next output $x_i$ via the formula $x_i = x_{i-1}^ e\mod n$. I can see ...
3
votes
1answer
442 views

Does rsa-oaep provide or not plaintext integrity in addition to confidentiality?

My own understanding (possibly wrong of course) of RSA-OAEP encryption scheme is that it provides plaintext integrity (in addition to confidentiality) due to MGF function which for encryption ...
3
votes
1answer
3k views

Certificate signature with SHA-1 and RSA: where do 1888 bits come from?

Plenty of X.509 Certificates use "PKCS#1 SHA1 with RSA encryption" as the Certificate Signature Algorithm for generating a 2048-bit signature. The SHA-1 hash function generates a hash value of 160 ...
3
votes
3answers
945 views

Feasibility of finding public key when private key is known

We all know that in a public key cryptosystem, given a public key it is extremely hard to compute private key from it. Is it the same case in reverse? Given a private key, how easy is it to compute ...
3
votes
2answers
3k views

Chosen-Message-Attack RSA-Signature

I know that because of the multplicative property of RSA $s =(s_1s_2) \bmod n = (m_1m_2)^d \bmod n$ If Oscar wants to sign now an own message $m$ he chooses another message $m_1$ with $\gcd(m_1,n)=...
3
votes
0answers
188 views

RSA security assumptions - does breaking the DLP also break RSA? [duplicate]

Possible Duplicate: Would the ability to efficiently find Discrete Logs have any impact on the security of RSA? I'm wondering if breaking the DLP, that is the basis for ElGamal and DSA, would ...
3
votes
1answer
227 views

Role of lHash field in RSAES-OAEP

The RSA encryption padding of RSAES-OAEP has a lHash field set to the hash of a label. That label is typically the empty string, or some public description of the intended use of the message. Does ...
3
votes
1answer
351 views

RSA Timing Attack and Prevention through blinding

I am kind of confused regarding timing attacks on RSA. I do understand that the attack exploits the fact that the modular exponentiation (square and multiply) has key dependent branching. That is, if ...
3
votes
1answer
542 views

RSA Without Padding?

I've been looking at the weakness with plain/textbook RSA, where the same message is encrypted and sent to multiple destinations. In this case, it is possible to recover the message. Given that an ...
3
votes
1answer
102 views

Does choosing N to be product of safe primes avoid William's p+1 factoring attack on RSA?

In this post, I found that choosing RSA modulus $N$ to be product of safe primes avoids Willam's $p + 1$ factoring attack. Suppose $N = p \cdot q$, where $p$, $q$, $(p-1)/2$ and $(q-1)/2$ are primes. ...
3
votes
1answer
842 views

RSA: Most significant key bit always 1?

Is it possible to say that the most significant bit of an RSA private exponent is always 1? Wouldn't that weaken the key strength by exactly that one bit? I refer to the paper "Timing Attack: What ...
3
votes
1answer
12k views

PGP public RSA key format

I have been trying to use Go (I could post the code, but I think I posted enough already...) to generate a PGP RSA key. However every time I try to encrypt something with it, something fails. However, ...
3
votes
2answers
3k views

RSA: Is it secure to use the private key to encrypt and the public key to decrypt?

This may sound weird: What if I don't let others know my public key, then use my private key to encrypt, and the public key to decrypt? Is this secure? Let me explain a little bit: Common usuage: use ...
3
votes
3answers
9k views

RSA Key generation: How is multiplicative inverse computed?

As per Wikipedia, RSA keygen goes like this: Choose two distinct prime numbers p and q. Compute $n = pq$. Compute $\varphi(n) = (p − 1)(q − 1)$. Choose an integer e such that $1 < e < \varphi(n)...
3
votes
1answer
961 views

Decrypt all RSA ciphertexts if you can break 1% of them

I was given a cryptography question during an interview the other day. Imagine you are given an efficient algorithm which for a given RSA public key (n,e) is able to decrypt 1% of the messages ...
2
votes
1answer
180 views

Deletion complexity in a RSA accumulator

My question is about the existence of a dynamic RSA accumulator with deletion of an element in O(1) time. Do you know some practical implementation?
2
votes
1answer
573 views

RSA with small decryption exponent

I've heard that textbook RSA is insecure when decryption exponent $d$ is smaller than $N^{1/4}$ where $N$ is the public modulus. Why is it the case and what would be a simple explanation of the ...
2
votes
2answers
520 views

RSA find public exponent

Suppose I have an encryption oracle which can encrypt $m^e \mod n$ for any $m$. I know $n$ and I know $\varphi(n)$. However the public exponent $e$ is secret. Is it possible to figure out it's value ...
2
votes
1answer
150 views

Finding missing bits mathematicaly in a DLP situation (full problem)

In a preparatory question we had to recover decimal digits $@$ of $r$ and $s$ given $g=51234$, $h=90403$, $N=111649$, $r=3@497$, $s=276@3$, with $r$ and $s$ the smallest positive solutions to $g^r\...
2
votes
1answer
2k views

What is the correct value for “certainty” in RSA key pair generation?

I'm creating an RSA key pair in Bouncy Castle and need to specify an int value for certainty. This Stack Overflow answer says it is a relative test for how prime the values are. There is another ...
2
votes
1answer
51 views

Does the multiplicative property apply to modern, non-text book RSA?

I'm aware of the multiplicative property of the textbook RSA and how it can be used to get a signature from a CA without having the CA directly signing it. My question is - can this apply to the real ...
2
votes
3answers
1k views

Maximum length in bits of the product n=pq

If p and q are two 1024-bit prime numbers, would the maximum length in bits of product $n=pq$ be ${1024}^2$ or $2^{1024}$? I think it is ${1048576}={1024}^2$? Also, would the least significant bit ...
2
votes
2answers
2k views

How does this happen in RSA malleability?

I don't understand how the $E(m)$ turns into $E(mt)$. I mean, I don't know how does that transformation happen and how does the equation occur. $$E(m) \cdot t^e \bmod n = (mt)^e \bmod n = E(mt)$$ ...
2
votes
1answer
1k views

using Post-quantum asymmetric ciphers instead of RSA

We can't trust RSA to encrypt our Emails so what is best post-quantum cryptography system as alternative for RSA which provide good security and don't be breakable? because McEliece cryptosystem looks ...
2
votes
1answer
725 views

How do we guarantee plaintext is coprime in RSA?

The specifications for RSA state: $P^{\phi(N)} \equiv 1 ~mod~N$ if and only if $P$ and $N$ are coprime. Here $P$ is the plaintext and $N$ is the product of two suitable primes $x_1, x_2$. My question ...
2
votes
2answers
2k views

Can e = 2 be used in unpadded RSA?

I am wondering whether $e = 2$ can be used in unpadded RSA... It seems like it is not possible to use it: the value of e needs to be coprime with $tot(n)$. $tot(n) = (p - 1)(q - 1)$ where $p$ and $q$ ...
2
votes
1answer
172 views

If RSA Signature is not Decryption, why is it not advisable to use same keys for enc/dec and sig/ver? [duplicate]

If RSA Signature is not Decryption, why is it not advisable to use same keys for enc/dec and sig/ver? What is the proof where you may be exposing your private key when you use the same one for ...
2
votes
1answer
127 views

Need help understanding this exercise's solution

We were given this exercise, which asks us to identify the types of keys used on this diagram: The solution was Kxa -> A's private key Kya -> A's public key KxB -> B's private key My question is, ...
2
votes
1answer
110 views

In RSA, what's the risk of revealing $p^e\bmod N$?

Assume a common RSA public key $(N,e)$ with $N$ the product of two unknown distinct randomly chosen large primes $p$ and $q$ of about the same size. Does revealing $p^e\bmod N$ (in addition to the ...
2
votes
1answer
436 views

How would you find the Blinding factor R in RSA blind signature algorithm?

How would you find the Blinding factor $R$ in RSA blind signature algorithm when having – for example – $p=11$, $q=3$, message $m=6$, and public key $pk=7$? The answer doesn’t have to use the numbers ...
2
votes
1answer
398 views

How to identify RSASSA-PSS from rsaEncryption OID?

Following the RFC 8446 it states that: RSASSA-PSS RSAE algorithms: Indicates a signature algorithm using RSASSA-PSS [RFC8017] with mask generation function 1. The digest used in ...
2
votes
1answer
329 views

Determining message given cipher-text and public key [duplicate]

Consider the following scenario: Suppose A and B have set up their RSA public keys, namely $(e_a, n)$ and $(e_b, n)$, where the n-value is the same. Also, it happens that the $\gcd (e_a, e_b) = ...
2
votes
2answers
762 views

How to encrypt file with RSA and AES that anyone with RSA key can decrypt them?

How to encrypt a file with RSA and AES-256 that anyone with RSA key can decrypt them?.
2
votes
1answer
151 views

Secure multi-party computation for digital signature

Is there any practical algorithm that will allow to use public key cryptography (RSA or ECC) in the following way There are N parties. Up to M are malicious adversaries (were trusted, but got taken ...
1
vote
0answers
202 views

Is a RSA 2048 bits public key secure [duplicate]

I realize servers such as Google, Yahoo, which use RSA has 2048 bits public key. After comparing those keys, I realize that the public keys share a common property, that is first 9 bytes and last 5 ...
1
vote
2answers
2k views

Why is RSA decryption the inverse of encryption?

In RSA, to encrypt a message, the following formula is used: $$c=m^e\bmod n$$ For decryption, $$m = c^d\bmod n$$ is used. However, when I try to substitute the value of $c$ from the first into the ...
1
vote
1answer
1k views

RSA padding: what is it and how does that work?

If I am not mistaken, plaintext RSA is not secure. So, I have read that padding and hashing is needed to make the RSA algorithm secure. However, I am confused on what does padding or armoring mean in ...
1
vote
1answer
1k views

Algorithm for factoring knowing RSA private key

According to this and this paper from Alexander May is possible to factor given the knowledge of the RSA private key. This is possible via Coppersmith and LLL reduction. Now I am trying to implement ...
1
vote
1answer
223 views

Factoring RSA weak modulus

Given a public key for RSA, I have extracted the modulus which looks like this : ...
1
vote
2answers
508 views

What are the possible applications of fully homomorphic RSA algorithm?

As far as I know, RSA is not used for encrypting large files. Instead some symmetric key algorithm like AES or DES is being used for encryption with a random key and that random key is then encrypted ...
1
vote
0answers
89 views

Two untrusted party want to exchange data: how to ensure each one gets the data it needs? [duplicate]

Possible Duplicate: Two untrusted party want to exchange data: how to insure each one gets the data it needs? I am trying to come up with what could maybe be a novel algorithm for an application ...
1
vote
1answer
470 views

chaining rsa with ecies

In an answer to a previous question it was suggested that one way to protect your asymmetrically encrypted AES-256 keys, from say a solution to prime factorization, would be to chain asymmetric ...
1
vote
2answers
1k views

Attack RSA knowing the public key and brute forcing all possible message

Alice want to send a message $m$ to Bob, and encrypt it with Bob public key $K_B$. $A \rightarrow B : \{m\}K_B$ Lets assume I have intercepted $\{m\}K_B$, I know $K_B$ and I know that $m \in D$ (...
1
vote
3answers
147 views

Negotiate a secure connection without certificates?

I would like to have a simple experience for a user for setting up a secure connection between two computers against a MITM attack. Something like the following: A number (possibly base64) appears ...
1
vote
1answer
76 views

Forging RSA1024 signature with e=3 where hash is right justified

I am trying to understand (in the frame of exponent 3) how to calculate a "forgery" in the case where the desired result is: xxxxxxxxxxx[...]xxxxxxxxxxxxxxxxxxxxHHHHHHHHHHH[...]HHHHHHHH where HH = a ...
1
vote
1answer
4k views

Cube-Root attack - RSA with low exponent

I have this RSA public key ...
1
vote
1answer
84 views

TLS-conformant ciphertexts and SSLv2-conformant ciphertexts for Blechenbacher attack for DROWN attack

This is regarding the published paper on the DROWN attack (https://drownattack.com/drown-attack-original-report.pdf) It was mentioned in the paper that for TLS, RSA PKCS#1 v1.5 is used to encapsulate ...
1
vote
4answers
661 views

Message exchange with textbook RSA

I am working on this exercise but can't work out the answer to the question b. I have solved the question (a) by decrypting the ciphertext $C = 2$ using the formula: $$ M = C^d \bmod n = 2^{17} \bmod ...