What's the deal with Deno? We talk with a major contributor to find out. Listen now.

# Questions tagged [rsa]

An asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption with proper paddings.

2,169 questions
Filter by
Sorted by
Tagged with
2k views

### How does PKCS 1.5 solve the insecureness of Textbook RSA?

As we know, Textbook RSA is not enough safe to use because of the following issues; Guessable plaintext problem Small $e$ issue I want to know how PKCS 1.5 solved these problems.
1k views

### Why is pqRSA in the NIST PQC submissions?

In the NIST post-quantum cryptography workshop, the round one submissions included pqRSA. If memory serves, this is an implementation of RSA using the product of a very large number of 4096-bit primes ...
2k views

### uniqueness of the RSA public modulus

What is the probability that two separate RSA public moduli are the same? For example, consider a 2048-bit modulus. The number seems to be huge, but the choice for prime factors p and q is much more ...
7k views

### Why hash or salt when signing? [duplicate]

I've seen an example of how to sign using RSA. Besides the signing itself (s = m^d mod n) it also hashes and adds an IV. Why is that needed?
3k views

### Why is the complexity of RSA-1024 80 bit and not 86 bit?

Why is the complexity of RSA-1024 80 bit and not 86.76611925028119 bit? Here is the complexity for the GNFS (pulled from the linked Wikipedia article): \exp\left( \left(\sqrt[3]{\frac{64}{...
4k views

### Why should the RSA private exponent have the same size as the modulus?

Consider the generation of an RSA key pair with a given modulus size $n$ and a known, small public exponent $e$ (typically $e = 3$ or $e = 65537$). A common method is to generate two random primes ...
3k views

### Why can ECC key sizes be smaller than RSA keys for similar security?

I understand how ECC is based on the discrete log problem and RSA on integer factorization. I've read several references that show how a solution to either of these problems can typically be adapted ...
17k views

### RSA cracking: The same message is sent to two different people problem

Suppose we have two people: Smith and Jones. Smith public key is e=9, n=179 and Jones public key is e=13, n=179. Bob sends to ...
8k views

### Can an RSA private key have several public keys?

Ok, so my cryptography lecturer in University posed this question at the end of the RSA key generation lecture as a brain teaser. I have been thinking about this and I think I have come up with a way ...
1k views

758 views

### Is an RSA variant with public exponent $e=f+(p-1)\cdot(q-1)$ safe (for $f$ random in some small interval)?

Alice is going to use some existing RSA scheme (employing industry-standard signature or/and encryption with proper padding), which she can't change, or influence beyond her choice of key. In this ...
7k views

### How do other, non-RSA algorithms, compare to the PKCS #1 standard?

Arguably the PKCS suite of standards have a profit-oriented bias as they are promoted by RSA and promote their algorithms over others in the form of RFCs and other means. I'm considering the ...
991 views

### Can Shor's algorithm compromise RSA when both the public and private key are secret?

If RSA is to create a public private key pair and encryption is performed on plain test P to create cipher text C, given P and C could Shor's algorithm be used to find either of the public and private ...
1k views

### Given a message and signature, find a public key that makes the signature valid

Given a message $M$ and a signature $S$, is it feasible to find a RSA public key $(n,e)$ such that $S$ verifies as a valid signature on $M$ (using this public key)? What if we're given one public key ...
2k views

### Is Bouncycastle RSA+OAEP implementation vulnerable to Mangerās attack?

I have written a code to encrypt a plaintext as below. Here I am using bouncycastle crypto provider and referring to the RSA+OAEP for that. ...
12k views

### Should I be using PKCS1 v1.5 or PSS for RSA signatures?

I am implementing an application where a user needs to sign some data that they have created, store it in an untrusted place, then later retrieve that data and verify it is still authentic before ...
4k views

### RSA enc/decryption with multiple prime modulus using CRT

Every information I found on internet about RSA-CRT encryption/decryption uses only two primes. I'm interested in my project in doing that using multiple (up to 8) primes. The general idea is to ...
1k views

### Why isn't Rabin-Williams cryptosystem widely used?

I think we all know RSA. And of course we also know DJB (a.k.a. Daniel J. Bernstein). Now some already have noticed that he has an opinion towards cryptographic questions. In his 2008 paper ("RSA ...
4k views

### ECDSA vs RSA: Performance on Android platform and surprising results

For our privacy-preserving protocol, an encrypted channel is established. In order to protect our system from man-in-the-middle attacks, signature-based approach is used. After we've implemented it ...
1k views

### What does “Inverting the RSA function is as hard as factoring” mean (a rigorous explanation or intuitive will do)?

I was reading that a current open problem is if inverting the RSA function is as hard as factoring. Does this mean that, its an open problem whether, if given a subroutine that computes in ...
859 views

### Is it possible to have multiple RSA private keys?

I just did some math: Pick $p$ and $q$ distinct primes; Calculate $N=p\cdot q$; Calculate Euler`s totient => $\phi=(p-1)\cdot(q-1)$; Pick an $e$ (public key), coprime with $\phi$; Calculate $d$ (...
488 views

### Deterministic RSA blinding

I have an implementation of the RSA private key operation in a context where I don't have access to an entropy source. I'd like to add blinding to it (both message and exponent), to make it resist ...
788 views

### why did oaep change from pkcs1 v2.0 and v2.1?

In PKCS1 v2.1 the OAEP output is prepending with a null byte. Quoting RFC3447, ...
1k views

### State of the art RSA key generation

I would like to know if there is an algorithm to generate a RSA key at the state of the art of the present cryptanalysis. Beside the key lenght I know there are some weakness in the choice of prime ...
5k views

### How are IVs used in association with RSA Encryption?

How are IVs used in association with RSA Encryption? Can someone explain why we use them in this RSA context?
4k views

### How can I determine the GPG/PGP key ID from the RSA modulus?

According to http://www.pgp.net/pgpnet/pgp-faq/pgp-faq-keys.html#key-public-key-forgery, key ID is some lower bits sequence from the modulus (i.e. the $n$ variable): A PGP key ID is just the bottom ...
2k views

4k views

### RSA4096 vs AES256 for secure Chat application?

Which of these two methods suits better the implementation of a secure chat application? In this context, chat will be limited up to 150 letters for one message. I would prefer RSA because what I ...
10k views

### Is RSA-OAEP deprecated?

I need asymmetric pub/private keypair encryption in JavaScript. Web browsers support RSA-OAEP, which works exactly as I need. But there is a table which lists supported algorithms for web crypto at ...
4k views

### Can an ephemeral RSA key give forward secrecy?

Suppose party A generates an ephemeral RSA key and sends the public key to B. Party B then generates a symmetric key, encrypts it with Party A's public key and sends the Ciphertext to Party A. Party ...
4k views

### Is knowing the private key of RSA equivalent to the factorization of $N$?

Given the RSA modulus $N$ the fastest method to factor it is of sub-exponent order. But, now if I know the private key $d$ of RSA, does that mean I can factor $N$ efficiently?. It intuitively seems ...
984 views

### Would RSA make sense if we used no computers?

I was recently wondering - would RSA be useful if we brought it to, say, medieval times? Could you choose the keys so that you could encrypt/decrypt messages quite easily, but factoring the private ...
19k views

### Why are RSA ciphertexts different for the same plaintext?

I am using SpongyCastle for a project in android. I have used RSA to encrypt the data and then decrypt it in another activity, the keys are stored in the shared preferences. I discovered a thing I ...
3k views

### Is RSA of a random nonce with no padding safe?

Consider the following protocol: Bob has a private RSA key $B_{priv}$, and Alice knows the public key $B_{pub}$. Alice wants to send confidential messages to Bob (no integrity intended). To send a ...
16k views

### In RSA, do I calculate d from e or e from d?

In the original paper introducing RSA, it is implied that one should first choose $d$ and then calulate $e$ from $p$, $q$, and $d$. However, I have found in other places (such as the wikipedia article ...
1k views

### How does Clifford Cocks 'Non-Secret Encryption' work?

I have read Clifford Cocks "A Note on 'Non-secret Encryption'" and thought I would try to implement this, but I don't seem to be able to get it to work. I'm obviously missing something. From the ...
1k views

### The 9 lives of Bleichenbacher's CAT, it puts another scratch again

Bleichenbacher demonstrated a padding oracle attack against RSA implementations that follow the PKCS #1 v1.5. Through the years, there are various mitigation techniques developed as OAEP and limiting ...
6k views

### RSA with 3 primes

I was trying to understand how does RSA with 3 primes work. I have checked Wikipedia but yet I didnāt fully understand their solution. I would like to know how do you encrypt for $n=p*q*r$ How do you ...
6k views

### Reverse engineering secret key in RSA encryption with the help of signature

Consider the following: $i$th message, $m_i$, in its original state. $i$th message, $M_i$, encrypted message $m_i$ using public key. Public key, $p$, in a $b$-bit RSA encryption setup. We can ...
13k views

### what are DP and DQ in Encryption by RSA in c#

I want to know about these tags in RSA Encryption by private Key. when I use this code: ...
3k views

### What is the difference between “wrapping” a key and encrypting?

I wanted to implement a way to generate an RSA public/private key pair and protect the private key with a password. Looking into the Web crypto api, I thought the ...
972 views

### How to argue to a paranoid that RSA is safe?

From today's standpoint, most people would claim RSA to be secure. However, to my knowledge, this is purely based on the speculation that no one knows a computational feasible way to find a $d$ for ...