Skip to main content

Questions tagged [rsa]

An asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption with proper paddings.

Filter by
Sorted by
Tagged with
0 votes
1 answer
35 views

Threshold signature scheme for centralized group broadcast

I am looking for a threshold signature scheme (or similar proposals are happily accepted) that suits the following scenario: One Base Station is transmitting signed broadcast message to all members in ...
Tom's user avatar
  • 101
8 votes
1 answer
3k views

Are RSA signatures distinguishable from random data?

In the spirit of Are curve secp256k1 ECDSA signatures distinguishable from random data? Are RSA signatures distinguishable from random data? What if you don't know the message? What if you have many ...
Mark Omo's user avatar
  • 189
0 votes
1 answer
235 views

Encrypting large files using RSA and AES-256-CBC-HMAC-SHA256

I developed an application that stores large files. Those files are stored in plain text. Now the project owner wants those files be encrypted on storage, he wants confidentiality, integrity, and ...
Jesús López's user avatar
0 votes
1 answer
132 views

Is there a benefit in cryptography to return 0 in square and mutliply algorithm when a modulo is 0?

When a modulo is 0, the result of squaring or multiplying modulo will always be 0 as well. Therefore the loop could break and return 0. It can be a mean to compute faster the result of square and ...
Christophe Brun's user avatar
0 votes
1 answer
104 views

Looking for a modifiable signature!

I am a graduate student and have encountered some problems in my research. When I generate a signature on the data block of the file, and the signature is composed of the user's private key, the data ...
nan gan's user avatar
0 votes
1 answer
51 views

Compute a proof for a verifiable delay function

I am trying to solve the following problem: Alice generates a RSA key $(n, \phi)$, she shares with Bob the value $n$, and $y = g^{2^{t}}\;\text{mod}\; n$ for $g$ a generator of the group $\left(\...
Kroki's user avatar
  • 111
0 votes
0 answers
60 views

Finding plain text given two cypher texts of the same plain text with two diffrent public keys

I want to find the plain text from two cyphertexts of RSA, encrypted with two diffrent public keys. I know that: for E((n,e),m) = c0 and E((n,f),m) = c1 , c0^x . c1^y mod n = m mod n = m (ex + fy=1) ...
dskrby's user avatar
  • 1
1 vote
1 answer
118 views

Why are the primes all the same size in pqRSA?

pqRSA is MP-RSA with 4096-bit primes to build up a modulus of up to 1TB. If the objective is to make processing the modulus as expensive as possible for the quantum computer why not use just two 4096-...
user avatar
3 votes
2 answers
1k views

RSA key generation with large random numbers and no primality testing

Does the security of RSA rest entirely on the modulus having at least 2 large random primes? Suppose you were to generate 2 random 1,000,000-bit numbers and just use the product of those as the ...
user avatar
1 vote
1 answer
58 views

Who invented asymmetric cryotography [closed]

I am reading a book about blockchain. It said the asymmetric cryptography was invented by Whitefield Dime and Martin Herman in 1976. But I cannot find these two guys. Furthermore, what I know was RSA ...
Quant's user avatar
  • 13
1 vote
0 answers
90 views

Time-memory tradeoffs in RSA Meet-in-the-Middle attack

We assume a standard secure RSA public key $(n,e)$, e.g. 3072-bit $n$ and $e=65537$. The Meet-in-the-Middle attack (not to be confused with Man-in-the-Middle attack) on textbook RSA recovers $m$ from $...
fgrieu's user avatar
  • 142k
2 votes
2 answers
307 views

RSA: Is padding necessary for key exchange?

When RSA is strictly used to exchange random shared secrets, is the padding scheme important for security or can it be omitted entirely? The party in possession of an RSA public key will generate ...
user avatar
0 votes
1 answer
148 views

Is a prime shifting method for RSA modulus generation safe?

I have a prime number, $p$, with $n$ bits. To generate a new prime number, $q$, I shift the bits of $p$ from left to right by a certain length. For example, if $p$ is represented as ...
Lisbeth's user avatar
  • 497
2 votes
1 answer
104 views

1-out-of-2 Oblivious Transfer with RSA

I'm trying to implement a simple 1-out-of-2 Oblivious Transfer with RSA. I was checking the code and tried to work it step by step. The 2 messages by Alice, let's say, are $m_0 = 7$ and $m_1 = 9$. Bob'...
Guest's user avatar
  • 21
3 votes
2 answers
562 views

RSA perfect square phi

So I've been learning about RSA for quite a while (mainly by playing around in CTF competitions) and I came across an interesting problem. The other day I was looking to create a challenge in which I ...
Anonymous's user avatar
0 votes
2 answers
108 views

Cannot get RSA encrypt and decrypt to work in hardware and online calculator

I am attempting to get a hardware implementation of RSA working but I am having trouble with encryption and decryption. First, I ran these commands to generate the keys: openssl genrsa -out private-...
Jordan Krim's user avatar
2 votes
2 answers
812 views

In RFC 2313 (PKCS1/RSA) said you could recreate the Private key from 'n' and 'd', which later versions removed. Why?

RFC 2313 has this specific callout: ...
rip...'s user avatar
  • 123
0 votes
1 answer
149 views

Possible to encrypt message without knowing recipient public key?

Assume Bob is sender and Alice is future recipient. In ideal situation Bob know Alice public key, and encrypt message with it. But what if Bob don't know Alice public key (he only will know Alice ...
byXrom's user avatar
  • 3
0 votes
1 answer
95 views

Prove that if $e.d \equiv 1 \text{ mod } pq$ then it's impossible to have $e.d \equiv 1 \text{ mod } (p-1)(q-1)$

I am studying RSA cryptosystem and here is the question that came to my mind. Let's pick $p, q$ to be two primes and $n = p * q$. From that we calculate Euler's totient function: $$ \phi(n) = (p - 1)(...
QuestionEverything's user avatar
3 votes
2 answers
88 views

What happens if we know that for an RSA key pair, the equation $d^e \equiv c \pmod{n}$ holds?

If we possess the knowledge that the expression $d^e \equiv c \pmod{n}$ holds for an RSA key pair, what would be the implication or consequence of this? Here, $e$, $n$, and $d$ represent the public ...
Lisbeth's user avatar
  • 497
0 votes
2 answers
153 views

Chinese Remainder Theorem in a strange configuration

Normally, the chinese theorem looks like this:$$ x = a_1 \bmod n_1\\ x = a_2 \bmod n_2\\ x = a_3 \bmod n_3$$ but what to do if in my situation it looks like this:$$ c_1 = x^e \bmod n_1\\ c_2 = x^e \...
vert3x's user avatar
  • 1
0 votes
2 answers
381 views

Are Safe and Sophie Germain primes evenly distributed?

Do Safe and Sophie Germain primes maintain a relatively stable distribution as numbers get larger, or do they become rarified beyond a predictable value? This is important in one area of triangular ...
Zekchelovek's user avatar
3 votes
3 answers
437 views

"crandall" - unsolved CTF challenge - ASIS-quals-2023

...
akonzu's user avatar
  • 59
0 votes
0 answers
81 views

Textbook RSA on random numbers mod a smaller prime

I have a protocol where I have a random one-time number message $m \in \mathbb{Z}_p$, where $p$ is a 256 bit prime from an Elliptic Curve (EDIT: The order of an elliptic curve prime order group). I ...
Zarquan's user avatar
  • 313
2 votes
1 answer
264 views

Is there an algebra group (or ring) in which computing the inverse element is hard without some trapdoor information?

Specifically, I want an algebra group $G$ (or ring $R$) features: Given elements $g,h\in G$ (or $R$ ), computing $g\cdot h \in G$ (or $R$ ) is easy. Given an element $g \in G$ (or $R$ ), finding the ...
X.H. Yue's user avatar
  • 392
0 votes
0 answers
652 views

How to create RSASSA-PSS keys using openssl?

I am trying to understand the RSASSA-PSS and process of generating keys with rsassaPss. I am using below ...
Preeti 's user avatar
  • 109
0 votes
0 answers
69 views

How to find modulus and decrypt a message with a CPA on textbook RSA. The encryption oracle only allows two queries

The encryption oracle only allows you to encrypt a custom message $m$ or the secret message $m_s$. In both cases it asks you to choose a public exponent $e>16$. Of course, $n$, is not available. If ...
crypt potato's user avatar
1 vote
1 answer
82 views

Is gcd(e,p−1)=1=gcd(e,q−1) similar to gcd(e,phi(n))=1?

I wonder, is $\gcd(e,p−1)=1=\gcd(e,q−1)$ similar to $\gcd(e,\phi(n))=1$ ??
Nicha59's user avatar
  • 11
3 votes
1 answer
240 views

RSA/ ECC keygen HW vs SW

i have a pretty straightforward question but i can’t seem to find an answer : Regardless of the physical protection provided by an HSM or TPM or any hardware cryptographic key storage system, are keys ...
khaled's user avatar
  • 51
0 votes
0 answers
50 views

In RSA Encryption, Can I choose the public exponent e > m (modulus) ? or e > φ(n)? [duplicate]

In RSA ,the encryption, Can we choose the public exponent (e) greater than m (modulus) or e > φ(n) ? I wonder about choosing public key exponents (e) because the most information on the internet or ...
Nicha59's user avatar
  • 11
3 votes
1 answer
139 views

How much can we compress RSA public keys with two equal size factors?

Can we define an RSA variant in which the public key with $n$-bit public modulus $N$ has a compact representation of $\kappa\ll n/2$ bits, with a security argument that it is as safe as regular RSA ...
fgrieu's user avatar
  • 142k
4 votes
1 answer
176 views

Is this new bound for Wiener Attack well accepted?

I found this recent paper The Wiener Attack on RSA Revisited: A Quest for the Exact Bound, which reported a new bound $d\le \frac 1 {\sqrt[4]{18}} N^\frac 1 4$. Is this well accepted in the ...
Zixi Sean's user avatar
  • 159
0 votes
0 answers
54 views

In RSA Encryption, Can the public exponent e > m (modulus) ? and can we choose any public key without paying attention to the conditions? [duplicate]

In RSA ,the encryption, Can we choose the public exponent (e) greater than m (modulus) or e > φ(n) ? I wonder about choosing public key exponents (e) because the most information on the internet or ...
Nicha59's user avatar
  • 11
10 votes
5 answers
2k views

Best cryptographic algo with asymmetric cost: expensive to sign, cheap to validate

I'm looking to prevent a DDoS attack on a web service, by making the cost of performing an attack prohibitive. Typical users will only need to call out it once a day, and can afford to spend a few CPU ...
scosman's user avatar
  • 203
1 vote
1 answer
211 views

Cryptography to tackle deepfake, proving the photo is original

Deepfake technology has become very difficult to tackle due to sophisticated machine learning algorithms. Now, even when a journalist or bystander provides photo or video evidence, the culprit denies ...
Amiya Behera's user avatar
0 votes
0 answers
33 views

RSA derivation of ed=1 mod(ϕ(n)) [duplicate]

I know that $m =m^{ed} \bmod n$, and there is Euler's $a^{\varphi(n)} = 1 \bmod n$, but how do we derive that $ed=1 \bmod(\varphi(n))$ holds for all m. Where does that equality come from? Couldn't ...
steatoda's user avatar
0 votes
2 answers
596 views

Best cryptographic method to distribute license files

I will describe my problem high-level, and not ask a very specific cryptographic question, since I am open for general suggestions as well. So in my question I will only speak about "security ...
Allgaeuer's user avatar
  • 123
0 votes
2 answers
131 views

Is signature same as hash value encrypted with the private key in openssl?

Computing the signature of hello.txt file which has the text hello in it, here is done in two steps: ...
user112060's user avatar
1 vote
0 answers
96 views

Is there any harm using a pseudo-prime endorsed by a probablistic test like Miller-Rabin in RSA?

In RSA, the decryption exponent $d$ is typically calculated as $$d= e^{-1} \bmod{(p-1)(q-1)}$$ or $$d = e^{-1} \bmod \operatorname{lcm}{(p-1, q-1)}$$ where $p$ and $q$ are often randomly selected ...
DannyNiu's user avatar
  • 9,422
2 votes
1 answer
138 views

Operands size in RSA Cryptography (C language)

I am trying to implement the RSA cryptography algorithm using C language. I am not sure of the size that each operand should have. Let me explain: RSA requires to generate two huge prime numbers p and ...
Wheatley's user avatar
  • 147
1 vote
0 answers
29 views

Curious behavior of EVP_DigestSign for DKIM

Difficulties porting code to OpenSSL 3 may raise some doubts on digest signing. Before version 3 came, digest signing was the only way to use ED25519. On version 3, RSA_sign() being deprecated, I ...
Ale's user avatar
  • 111
0 votes
1 answer
271 views

RSA - Twin Primes across two messages

This was a CTF challenge I was unable to solve, but I thought I may had come close. We were given two $N$'s $N_1$ and $N_2$ each calculated with $P_1 \times Q_1$ and $P_2 \times Q_2$; however, $P_1 = ...
Nasica's user avatar
  • 1
0 votes
0 answers
53 views

RSA random key generation [duplicate]

How RSA keys are tested for primality if they are random generated? I imagine this could be time consuming task.
sergiu malutan's user avatar
4 votes
1 answer
190 views

RSA signature with random padding

I used to think that adding random padding to an rsa plaintext was to prevent attack when you can ask/have access to different ciphered output, and decipher it without access to the private key (under ...
Xilokar's user avatar
  • 41
3 votes
2 answers
325 views

Textbook RSA using multiple low public exponent e

I'm working on finding an attack on textbook RSA using non-prime, low public exponents $e_1,e_2$ for each encryption. Given $$c_1 = m^{e_1}\space mod \space n \\ c_2 = m^{e_2} \space mod \space n$$ I ...
LilLee's user avatar
  • 51
0 votes
0 answers
97 views

RSA encryption two characters at a time

I have a question in regards to a task I've been given at uni. I need to encode the string 'Cyber' 2 characters at a time with RSA with padding being space. What do ...
Stefan Shkenderov's user avatar
-1 votes
2 answers
217 views

Encrypt with private key decrypt with public key

I want to sign and transmit a short message, which contains a few simple hashes. My objective is not to prevent an attacker from inserting a fake message, but to ensure that the attacker cannot define ...
user23952's user avatar
0 votes
1 answer
77 views

Trying to understand the basic principle of RSA from Wikipedia

Quote from https://en.wikipedia.org/wiki/RSA_(cryptosystem)#Operation A basic principle behind RSA is the observation that it is practical to find three very large positive integers $e$, $d$, and $n$,...
axk's user avatar
  • 103
1 vote
1 answer
664 views

A RSA crypto CTF chanllenge with known private key ,cipher text and modules factor n

Here is a CTF chanllege about RSA(The competition has ended for serval hours),and here is the critical encryption code: ...
Ayumi80s's user avatar
1 vote
1 answer
118 views

RSA: in $E(x) \equiv x^e \pmod N$, do we apply the mod function to $x^e$?

When one is computing $E(x) \equiv x^e \pmod N$ (where $N = pq$) in RSA, what is the precedent for which number in the residue class of $x^e$ to have as the result of this computation? Does this mean ...
Princess Mia's user avatar

1
2
3 4 5
56