Questions tagged [rsa]

An asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption with proper paddings.

237 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
2
votes
0answers
67 views

Asymmetric encryption property required in an authentication protocol

We want to choose an asymmetric encryption scheme for use as follows: A device holds its private key, with the corresponding public key known and trusted by all. The device also holds a small $b$-bit ...
2
votes
0answers
176 views

What kind of RSA padding mode is it?

1: I have a HTTPS server and I added hooks in RSA decryption procedure to dump error RSA input(client key exchange). 2: I get some RSA input that I couldn't check padding successfully(It's usual) and ...
2
votes
0answers
333 views

RSA signatures that allow hash to move around in block

I'm looking at a broken RSA signature padding implementation in a real device. It's a very-badly implemented version of PKCS #1-like encoding, but before PKCS added the DER-encoded hash identifier. ...
2
votes
0answers
59 views

Does secure LWE implementation leak bit information?

We know RSA leaks one bit about the factors and improper yet secure implementations of Discrete Logarithm leak one bit about the discrete logarithm. Does LWE leak any information?
2
votes
0answers
186 views

Textbook RSA: Public key used to decrypt ciphertext and checked against known plaintext

In textbook RSA with no padding schemes, is it possible to forge a ciphertext that decrypts to a known plaintext when the ciphertext is encrypted using the private key and decrypted with the public ...
2
votes
0answers
118 views

RSA - find d,e with restrictions

For academic purposes, assuming $n, p, q$ with $n\approx 2^{4096}$ and $p,q\approx 2^{2048}$. I need to find ($e,d$) such that: $e$ is smaller than $2^{64}$ $d\approx 2^{4096}$ and will have as ...
2
votes
0answers
147 views

Estonian e-voting, vote verification system

I believe I do understand the basics of how the Estonian e-voting system works, but I'm stuck at their vote verification system. In order to get the vote verified, a client needs to encrypt all of the ...
2
votes
0answers
204 views

Montgomery modular multiplication – confusion with subtraction of modulus

I'm reading the paper “COMPARISON OF SCALABLE MONTGOMERY MODULAR MULTIPLICATION IMPLEMENTATIONS EMBEDDED IN RECONFIGURABLE HARDWARE” (PDF) on hardware algorithms for montgomery multiplication for ...
2
votes
0answers
380 views

Attacks on RSA with partially known plaintext

I know modulus $N$, public exponent $e$ and have some crypted messages $c_i$, $c_i = m_i^e mod N$. I know something about each $m_i$: they have a sequence of bytes BAADF00D at offset $t$. Is there ...
2
votes
0answers
229 views

HBCI Encryption/Decryption

I need help during implementation of C# interface (.NET framework) for encryption of messages which are sent to/from HBCI (Homebanking Computer Interface) server according to RDH-10 standard. ...
2
votes
0answers
173 views

Security of right-zero padded signatures with $e=3$

I am facing this question about RSA signatures and I understand that a hash encode is secure, but I was asked this: Given the scheme based on RSA assumption. Consider the RSA function f with some ...
2
votes
0answers
280 views

Asymmetric vs symmetric encryption

I am a beginner learning about encryption and I would like to ask a few questions, hoping this is the right place to ask, so please bear with me. We have Alice and multiple clones of Bob. Only Alice ...
2
votes
0answers
52 views

Decisional Small $e$-Residue Assumption

In 2001, Catalano et. al defined Decisional Small $e$-Residue Assumption as follows: Let $N$ be a random chosen $\ell$-bit long RSA modulus and $e>2$ a random integer such that $\text{gcd}(e, \...
2
votes
0answers
533 views

Feasible attacks on ECRSA cryptosystem

In ECRSA cryptosystem, I want to know the feasible attacks. For illustrations we have two prime $p$ and $q$ such that $p \equiv 2 \pmod 3$, $q \equiv 2 \pmod 3$ and generate key pair as follows: $$n = ...
2
votes
0answers
461 views

MITM Attack on Key Exchange Protocols

I was doing research on this attack and I am wondering, why is Diffie-Hellman always associated with such an attack? ​ Aren't other public key cryptography schemes vulnerable to the same kind of ...
2
votes
0answers
447 views

Limit the number of private key uses for RSASSA-PKCS1-v1_5 with SHA-256 signature?

Assuming all messages and their signatures are available to the attacker, is it secure to use the same RSA private key to sign many messages (roughly $10^{6}$) via PKCS#11 ...
2
votes
0answers
37 views

Are there UFDs where the factorization problem is difficult but finding irreducibles is cheap?

Factorization of integers is hard, but finding irreducibles is expensive. Is there a ring where factorization is assumed hard but finding irreducibles is much cheaper than over $\Bbb Z$? It could ...
2
votes
0answers
388 views

RSA_DH vs ECDH implementation

In ECDH protocol is possible, naturally, to use the same algorithm for calculate a secret key for both communication parties (Alice and Bob for example). It is possible to design also a same algorithm ...
2
votes
0answers
456 views

RSA encryption and signature padding flaw

This is Oxford's computer security exam question: Suppose that Bob has published an RSA encryption key $ke$ (retaining in secret the corresponding decryption key $kd$), and Alice has published a ...
2
votes
0answers
229 views

RSA Key Blinding

I was looking the answer to the following question (Timing attack on modular exponentiation), discussing the Private Key Blinding as a countermeasure for timing attacks. Therefore I'm asking if ...
2
votes
0answers
376 views

Defending hybrid encryption schemes against padding oracle attacks

I intend to use a generic integrated/hybrid encryption scheme for transmitting information between a client and a server. Key encapsulation: a 128-bit symmetric key is generated and asymmetrically ...
2
votes
0answers
572 views

Is this a secure (and correct) sign-then-encrypt technique for transferring messages?

After reading some information on the way iMessage works I have been working on writing some code to try my hand at securely transferring messages in a similar manner and I wanted to confirm that the ...
2
votes
0answers
135 views

Is it possible to modify SSL handshakes to enable PFS while still using RSA during the handshake?

I know we could possibly be using DH key exchange, that would enable PFS. However, what if we make modifications on our SSL 3.0 handshake such that the only cipher we use is RSA for the achieving PFS? ...
2
votes
0answers
296 views

Rabin/RSA four possible messages?

Given this encryption method: $$f_{N,e} : Z^{*}_{N} \to QR(N)^{*};\quad f_{N,e}(x) = x ^{2e} \bmod N$$ I need to show that, for any $x_{0} \in Z^{*}_{N}$, there are four elements $x \in Z^{*}_{N}$ ...
2
votes
0answers
104 views

Strong RSA problem in $\mathbb Z^*_{n^2}$

Comparing to this question, assume $C, M \in \mathbb Z^*_{n^2}$, $e \ge 3$, is it hard to compute $M$ that satisfies $C=M^e \mod n^2$ when $C$ and $(n, e)$ are given?
1
vote
0answers
44 views

Content Key Encryption for Multi-User data access

I recently worked out a concept for a use-case, but I'm not sure if my approach is good enough. So I would appreciate feedback and things to look out for, as I'm fairly new to this field. A User can ...
1
vote
0answers
48 views

Retrieve message from rsa ciphertext based on some conditions

Let's say: $x = m^{e-1}\bmod n$ $y = m^{d-1}\bmod n$ Here $m$ is a message, $e$ is public exponent, $d$ is private key and $n$ is the modulus. Now if I know $e, x, y$, and $n$, can I retrieve the ...
1
vote
0answers
23 views

Generating a recovery phrase for a RSA key-pair

What is an optimal way to associate a RSA key-pair with a recovery phrase/seed for access recovery purposes? I've seen a lot of cryptocurrency wallets provide this feature, however, I'm not looking to ...
1
vote
1answer
44 views

Finding RSA private exponent with a chosen ciphertext attack?

Let's say there's this blackbox app that has a known modulus $N$, private exponent $e$, and takes ciphertext $C$ encrypted against $N$ and $e$ input and outputs plaintext $M$. The encryption is done ...
1
vote
0answers
17 views

Could a private key recovery via modulus fault attacks be optimised by being able to choose the faulty moduli?

The paper 'Why One Should Also Secure RSA Public Key Elements' describes an attack where an adversary can fully recover a private key by injecting faults into the modulus before exponentiation takes ...
1
vote
0answers
21 views

Size of messages in timing attack on RSA Montgomery

I'm codin' timing attack on RSA Montgomery which compares two sets ( the first one includes those which need a reduction in contrary to the second one ). But I got troubles with the Montgomery ...
1
vote
0answers
20 views

Sorted merkle tree versus rsa accumulator

When compared to sorted merkle tree and rsa accumulator, which one is the best? Rsa accumulator has constant proof and it adds/deletes at constant cost. What is the verification cost for rsa ...
1
vote
1answer
113 views

Are there cryptographical flaws in this e2ee website chat widget?

For a product I'm developing I want to verify if the thinking behind it is cryptographically strong and secure. The product is a chat widget on websites of customers. Like an e2ee version of Intercom. ...
1
vote
0answers
38 views

The following exercise is given in our book and I don't know how to solve it. Could somebody show me how to do it?

$\textbf{13.10 (Probabilistic full domain hash).}$ Consider the following signature scheme $\mathcal{S} = (G,S,V)$ with the message space $\mathcal{M}$, and using a hash function $H: \mathcal{M} \...
1
vote
0answers
34 views

Compared with plain RSA , what is the advantage of randomised public key encryption scheme such as EIGamal encryption?

I am new to cryptography, I am very interested in cryptography, thank you for your answer.
1
vote
0answers
83 views

RSA with a prime substituted by a Carmichael number

If the public key in a RSA system is $(n,e)$ with $n=pq$, $p$ prime, $q <p$ a Carmichael number and $\gcd(e,(p-1)(q-1))=1$ then if $d$ is the inverse of $e$ modulo $k=(p-1)(q-1)$, I want to show ...
1
vote
0answers
68 views

Looking for a group where multiplicative inverse is hard but calculating multiple pairwise inverses is easy

I have an equation that comes up in trying to do an Attribute Based Encryption scheme, where users have certificates that sign off on attributes that are also watermarked. I perform a division to ...
1
vote
0answers
24 views

How to design a moderated, group for private messages?

I’m trying to figure out how I could create a private group that was P2P yet still allowed someone to moderate members (no public access to messages). I’m assuming standard hybrid encryption (RSA/EC + ...
1
vote
0answers
24 views

Help with next step in the Quadratic Sieve

So I am at the same step as someone from math.stackexchange but he never recieved an answer so I will copy-paste his question here: Say, for N = 90283, I compute bound 𝐵=𝑒(12+𝑜(1))(ln(𝑛)ln(ln𝑛√))...
1
vote
0answers
75 views

How does RSA encrypt a message? Are the message packets chained together?

This question is quite related to this one, but I am looking for more details. I am writing a very basic implementation to demonstrate how RSA works. My current implementation generates key pairs ...
1
vote
0answers
55 views

Verify XML digital signature

I'm trying to figure out how to verify an XML digital signature. I have received a signed XML response (in string) in following format: ...
1
vote
1answer
161 views

RSA algorithm, relationship of the plaintext $m$ with $p$

I am studying the RSA algorithm. If for example the plaintext $m$ has some relationship with prime $p$, let's say $m$ is multiple of $p$ (where $p$ is the $p$ in $n=p \times q$). Can this give an ...
1
vote
0answers
75 views

ZK Proof that a blinded message (for a blind signature) contains a certain value

I am toying with eCash systems and blind signatures, and I started with Chaum's original formulation. In particular, I'm using this formulation from this link: User ...
1
vote
0answers
36 views

Problems about parameters configures of Herrmann and May's method to solve linear modular equation

I'm reading Herrmann and May's paper; they introduced a method to solve multivariate linear equation modulo unknown divisors. It's shown in Table 1 that, for an 512-bit RSA modulus N with divisor p ...
1
vote
0answers
68 views

Decryption of RSA with e that has no inverse

I'm studying the RSA protocol and I was wondering if there was any way of decrypting a message if the $e$ doesn't have an inverse $\mod (p-1)(q-1)$. Usually, you have to choose a value of $e$ that is ...
1
vote
0answers
54 views

What is the state of the art in fast implementation techniques for modular exponentiation?

I want to calculate ($m^{e} \pmod{N}$) in C or C++. I want to use 2048 bits long modulus $N$ and thus the above process of ...
1
vote
0answers
167 views

Question about RSA timing attack and a Chosen Ciphertext Attack on RSA

I am quite new to the RSA and I have a couple of questions that confuse me. Q1: A Timing attack on RSA can be prevented _____________________________ A. By performing the “square and multiply” ...
1
vote
0answers
51 views

RSA Accumulator construction - how to pick the initial state?

I read about RSA Accumulators and I wish to construct one using a programming language of my choice. For selecting modulus N, I see various implementations picking the RSA-2048 number. Also, as the ...
1
vote
0answers
36 views

Precise Definition of 1-out-of-2 Oblivious Transfer

What's the precise definition for 1-out-of-2 OT? and what's the best way to show that it can't be achieved under unconditionally secure setting? I am reading about it and just couldn't get my head ...
1
vote
0answers
34 views

How to calculate RSA group signatures

RSA group/ring signatures, how are they calculated?