Questions tagged [rsa]

An asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption with proper paddings.

Filter by
Sorted by
Tagged with
1
vote
0answers
20 views

Can the hash of a PKCS1 v1.5 RSA signature be used as a key derivation function?

I know this sounds crazy, but hear me out. As a follow-up to Can the AES-GCM authentication tag be used as a key derivation function?, I'm also considering more creative solutions to derive unique (...
-2
votes
1answer
55 views

How to hack pass-protected private RSA key

I know nothing about cryptography. I must present a completed ASP project to my university that proves I have learned clingo. I have heard that the task of recovering the plaintext private RSA key ...
2
votes
2answers
196 views

Zero knowledge RSA public key

Suppose Bob has $k>1$ RSA public keys $(e_i, n_i)$ without any knowledge of their corresponding private keys. Alice also has all the public keys, but also has a private key for only one of them, ...
10
votes
8answers
13k views

Cracking RSA (or other algorithms) manually by a savant

RSA cryptography strength comes from the hardness (or so we believe) of factoring big numbers. For key lengths over 2048 bits, it is infeasible for current or near-future computers to factor those ...
0
votes
2answers
149 views

Factoring RSA when reusing N

Suppose in two RSA instances the same $p,q,N$ are used, but different public keys $a,b$ (and corresponding private keys) Suppose now we have the two equations $c_{1}=m^{a} \bmod N$ $c_{2}=m^{b} \bmod ...
2
votes
1answer
58 views

Is the relationship between private and public keys an example of bijection between two sets?

Just want to make sure that my understanding is correct whether there is only one public key for any private key, and vice versa. I know that there are many algorithms, and this may not be a property ...
1
vote
0answers
39 views

Bleichenbacher CCA, proof of termination

I am currently thinking about how to prove that the algorithm presented in Bleichenbacher's paper (http://archiv.infsec.ethz.ch/education/fs08/secsem/bleichenbacher98.pdf) actually terminates. I know ...
2
votes
0answers
187 views

Schnorr RSA factoring (round 2)

Introduction Earlier this year Claus Peter Schnorr claimed to have "broken RSA". The original paper was discussed in Does Schnorr's 2021 factoring method show that the RSA cryptosystem is ...
2
votes
1answer
167 views

Can you please explain how Manger's attack against RSA OAEP works?

I searched but found nothing except the original paper, and I can't wrap my head around it. Can you help me by giving an overview and then if possible, a short explanation of the algo?
3
votes
0answers
380 views

Is "Fast Factoring Integers by SVP Algorithms, corrected" correct?

Schnorr comes again. Will he really break RSA this time? But he still didn't give any concrete examples that can enable us to quickly verify his claim.
1
vote
1answer
82 views

Factors calculation in RSA

You are given $d\bmod(p-1)$ , $d\bmod(q-1)$ , $\operatorname{invert}(p,q)$ and $p\bmod2^{200}$, the public exponent is $e=65537$. $\operatorname{invert}(p,q)$ is the answer of $ p*x \equiv 1 (mod\quad ...
1
vote
1answer
62 views

Completing RSA Encryption

Being new to cryptology, I'm trying to understand how I would complete RSA encryption by hand. I can only follow the formula so far before becoming very confused. I want to encrypt the value "123&...
2
votes
1answer
413 views

How is it possible to derive the public exponent from an RSA private key?

I am gonna write down formulas that I know and use to generate RSA keys. we choose $p$, $q$ $N = p\cdot q$ $\varphi(n) = (p-1)\cdot(q-1)$ choose $e$ such as $1 < e < \varphi(N)$ $e$ is coprime ...
1
vote
0answers
38 views

Interval for PKCS#1 v1.5 compliant plaintext

In Bleichenbacher's paper (http://archiv.infsec.ethz.ch/education/fs08/secsem/bleichenbacher98.pdf, section 3.1) he concludes that if m*s is PKCS#1 v1.5 compliant we get the following interval: $2B \...
2
votes
1answer
54 views

Why is ECDHE safe when paired within signing?

I wanted several videos by Computerphile on Elliptic Curve Diffie-Hellman, digital signatures and TLS. For the most part I understand everything but something is bothering me. Computerphile made a ...
7
votes
2answers
831 views

Has there ever been any real world consequences of using probabilistic primality tests for RSA or other similar systems?

Considering the huge amount of RSA certs which have been generated, wouldn't there probably be a small number of certs where one of the primes which may have actually been a composite? Has this ever ...
1
vote
0answers
91 views

End to end encrypted chat design

I am in the process of creating a flutter application that will include direct messaging. You can message 1 person or a group of people. I want this to all be encrypted for privacy. The method I was ...
0
votes
0answers
48 views

How do you find RSA encryption key e?

How do you find RSA encryption key e when RSA modulus is n = 55 = 5 x 11 and your decryption is d = 37? Is this possible for large values of n say of the order of 1024 bits?
1
vote
1answer
70 views

PRNG For RSA (ANSI_X9.31)

I have a query please , I want to know how to generate random numbers using ANSI_X9.31 algorithm for RSA Algorithm please . Thank u
1
vote
1answer
47 views

Why does it take more time to decrypt the same file with 256 bit RSA in TEE than in REE?

We all know that TEE can utilize almost all of the CPU's performance, so its time spent encrypting files using RSA256 is less than that of REE. But why isn't decryption? Why does it take more time to ...
1
vote
1answer
53 views

Verifiable Delay Function: Trusted Setup

Efficient Verifiable Delay Function paper suggested that there is two way to construct the group. One of them requires trusted setup in the sense whoever constructs the RSA unknown group order needs ...
5
votes
1answer
203 views

Zero-Knowledge Proof of Equality between RSA Modulus and Prime Order Group

Assume there is an RSA public key $(e,n)$ such that factarization of $n$ is unknown to both prover and verifier parties. We also have a prime order group $G$ and a generator $g$ for the group. For $m\...
1
vote
1answer
45 views

CrypTool RSA Features [duplicate]

I am attempting to manually encrypt a plaintext message (message = MI) using RSA. I receive an answer of: 33,264 and 21,164. When I enter the same plaintext into CrypTool to confirm that my ...
0
votes
2answers
137 views

Am I Doing RSA Correctly?

I am trying to figure out how to complete RSA manually. I am trying to encode a simple block message (Mi). I used CrypTool to determine the encryption. When I "manually" computed the ...
0
votes
0answers
42 views

Decrypt Ciphertext Using different private key, given knowledge of original private key [duplicate]

A message, m is encrypted using a private key d. ...
1
vote
0answers
40 views

Verifiable Delay Function - Fake Proofs

For unknown group order such as RSA groups $ G %$, it takes $T$ sequential steps to compute the below function (time-lock puzzle). $$ y = g^{2^T} mod N$$ This paper states that if $ /Phi(N) $ (Group ...
1
vote
1answer
359 views

Is it alright to generate RSA keys with bit sizes other than 512/1024/2048?

I am keep generating RSA keys for 512/1024/2048/4096... as bit size. Each time the key length is increasing. Is it possible to generate/use keys other than the ...
0
votes
0answers
42 views

Decrypt encryptedKey session key using - AES-128 - PKCS-1#rsaes-kem-kdf2-kw-aes128

I have basic knowledge about how encryption algorithms work such as RSA, AES and so on. I have an XML response encrypted with both AES and RSA. I tried using OpenSSL to decrypt with several steps but ...
2
votes
2answers
261 views

VDF / RSA groups

I believe I am overthinking it; however, I need to clear out my doubts. What is exactly RSA groups and how their order is unknown? I know in RSA N is computed by multiplying two prime numbers (p and ...
0
votes
1answer
46 views

RSA encryption key conditions

I recently read the RSA cryptosystem but now I confused in key generation phase. According to the Euler's Theorem, we have just one condition: e.d = k.ϕ(N) + 1 where: "e" is encryption ...
30
votes
1answer
5k views

How was this 2048 bit number factored so fast?

I'm working on a CTF. The challenge is to get the contents of an encrypted message given the ciphertext and the 2048-bit RSA public key. I did finally get the flag after a few hours, but I'm still not ...
0
votes
0answers
124 views

Given $e$ and $d$, find $\phi(n)$

Let's say we have just RSA public and private exponents $e$ and $d$ but not the corresponding modulus $n$. Is there a method to find $\phi(n)$? This is for a CTF challenge. I am not concerned about ...
5
votes
1answer
236 views

Security of RSA-3072 with public exponent $2^{16}+1$

NSA recommendation for the pre-quantum period allows the use of RSA-3072 (https://apps.nsa.gov/iaarchive/programs/iad-initiatives/cnsa-suite.cfm), nevertheless, is it safe enough to do it with the ...
1
vote
1answer
59 views

RSA vs diffie-hellman + polyalphabetic cipher

My basic question is: How does RSA compare to using Diffie-Hellman + <some symmetric key crypto, e.g. a polyalphabetic cipher> Let's assume that factoring large numbers and computing discrete ...
2
votes
1answer
232 views

What is the 2021 Padding Recommendation for RSA?

What is the current, year 2021, padding Recommendation for RSA? PCKS1? 7? 11? OAEP?
2
votes
0answers
51 views

Large e in RSA but not Wiener attacks

How to find $d$ with large $e$ ? If $(3\cdot d)^4 \le n$ : Wiener attacks, so what if $(3\cdot d)^4 > n$ ?
0
votes
0answers
42 views

How is hybrid (RSA+DH) more secure than RSA quantitatively?

Is there any graph that serves as a comparative analysis for the factorization problem vs discrete logarithn problem? I am implementing an hybrid encryption algorithm (RSA + Diffie-Hellman) and it is ...
1
vote
1answer
308 views

Is there much difference in a RSA-4096 over RSA-3072 for support/speed and security?

I am in the process of created a signing certificate and i have an option of RSA-4096 or RSA-3072. Is there much difference in security between the two? I know people say RSA-3072 should be good until ...
0
votes
0answers
67 views

Given N and e in RSA and the ability to get signature s for any message m, can you find the value of the private key d?

Given N and e in RSA and the ability to get signature s for any message m ($s=m^d \mod{n}$), can you find the value of the private key d?
0
votes
1answer
127 views

RSA and Wiener's attack [closed]

I'm trying to do Wieners' attack for the case \ ...
1
vote
1answer
104 views

Subtle Crypto Algorithm Choice

I need to encrypt some text in the browser to be stored server side. After a little research I decided to use the SubtleCrypto API. I created the the crypto key using the following code: ...
0
votes
1answer
59 views

detect the RSA public key from encrypted text

we have a service who has a list of public keys got from clients (for example 1000 public keys. not too many) service gets an encrypted message from one of clients. this message is encryped with a ...
0
votes
0answers
50 views

How can I enhance the security level of my RSA code?

I am trying to enhance the security level of my RSA code that I implemented in Python. I tried to add blind operation, randomized algorithm to my RSA code (separately, not together), but I am not sure ...
3
votes
1answer
155 views

How many encryptions are needed before OpenPGP key privacy is violated?

According to an excellent answer describing the pitfalls of key privacy in OpenPGP: Theoretically, an all-zero key ID can be used as a way to discourage traffic analysis, but this is not a complete ...
0
votes
1answer
64 views

Is this protocol secure?

Before anyone freaks out, this is purely speculative and I am not developing a cryptosystem! I can't see anything wrong with this protocol, but my knowledge of cryptography is rather superficial: ...
8
votes
2answers
4k views

Is it proven that breaking RSA is equivalent to factoring as of 2021?

I can't find any publication that proves this.
2
votes
0answers
97 views

RSA plaintext repetition attack, (same plaintext, different ciphertext) [duplicate]

Billy wants to send a message to Bob. He generates secure primes p and q for each time he sends a message. However, he ...
9
votes
1answer
1k views

Does the security of RSA come from just the carries in multiplication?

Although it's hard for me to find a reference, it's my understanding that if you calculate $N = pq$ using $GF(2)$ polynomial multiplication rather than ordinary multiplication, it is easy to factor $N$...
1
vote
2answers
129 views

Why doesn't any cryptographic library apply the Lehman's method?

Lehman's method can be described as; Let $N=pq$. If the ration of $p/q$ is near a ratio of two small numbers $r/s$, then $ps$ and $qr$ are close to $\sqrt{nrs}$. The Fermat's method can be easy ...
2
votes
0answers
83 views

Security of Full Domain Hash (or not quite full)

Full Domain Hash is the simplest signature scheme based on a trapdoor permutation (such as textbook RSA) that enjoys a strict security reduction. It was introduced by Mihir Bellare and Phillip Rogaway:...

1 2
3
4 5
49