New answers tagged public-key
0
Almost a decade later and the same challenges exist.
We came up with more or less exactly the same solution as the author. We have pub $+K_n$ and priv $-K_n$ keys pr user $n$. Private key $-K_n$ is stored encrypted $E_{K_S}(-K_n)$ in the database. Private key $-K_n$ is used to decrypt $D_{-K_N}(K_d)$ any shared key $K_d$ user $n$ are authorized to access.
...
0
What is clearly missing from the answers is that your browser takes the public key of the rootCA associated with the website and hashes the intermediate certificate and then encrypts the hash with the public key of the rootCA. Once this is done the resulting encrypted hash should match the signature in the SSL certificate. If it does then the intermediate ...
0
Good question. WhiteBox Cryptography helps to protect the key in an untrusted environment. To that extent, it is indeed possible to design a system where the complexity of the private key retrieval will be equivalent or higher than the complexity of breaking the cryptographic algorithm itself (e.g. discrete logarithm).
However, from a real world application ...
3
There is already good scheme for this, Elliptic Curve Integrated Encryption Scheme (ECIES);
Once you exchanged the keys with ECDH, then you can use a KDF to derive any key length, HKDF is fine.
ECIES also authenticates the ciphertext as Encrypted-then-MAC. In order to use MAC, you need another key. You can use HKDF to derive many keys by providing different ...
1
Your approach can only be applied to RSA and only if you are using keys generated according to PKCS#11 version >= 2.40. The PKCS#11 standard defines (section 2.1.3 "RSA private key objects" in the 3.0 base specification): "Effective with version 2.40, tokens MUST also store CKA_PUBLIC_EXPONENT."
Therefore, you're able to get the ...
1
The most obvious: performance.
I know SPHINCS+ being an example where generating public key from the private key is especially costly, there may be other schemes where this is true, but I'm not aware of any.
Also, since it's PKCS#11 hardwares we're talking about, and we've mentioned the hash-based stateless signature SPHINCS+ now, we should also mention that ...
0
HMAC as message authentication code should be resistant to existential forgery
under chosen message attack, this is known as EUF-CMA.
HMAC as a pseudo-random function should be resistant to distinguishing attack under, again, chosen message attack, which is known as IND-CMA.
I'm quite certain about the MAC part, but I'm not absolutely confident about PRF ...
3
So after searching, turns out the 2nd version is the one given in the original RSA paper, "A Method for Obtaining Digital Signatures and Public-Key Cryptosystems".
I assume the 1st method is simply the standard since. As pointed out by a comment $\lambda(n)$ will always be smaller or equal to $\phi(n)$. In RSA, as pointed by Dave Thompsons, $\...
2
A digital signature makes use of two keys a private key that can be used for producing signatures and a public key that can be used for verification of signatures. The certificate contains information that ties the identity of the signer to the public (verification) key but does not allow anyone to deduce the private (signing) key.
Anyone can present a ...
3
No, it's not.
Alice knows her own $eH(ID)$ and she knows the corresponding private key.
But knowing those two is enough to calculate the factorization of $N$. A probailitstic algorithm to calculate $p,q$ from $e,d$ was in the original RSA paper, later and Alexander May showed in Computing the RSA Secret Key is Deterministic
Polynomial Time Equivalent to ...
5
No, this is not secure.
Problem is that Alice, knowing $d_{ID}$ and $e_{ID}$, can compute $f=d_{ID}\cdot e_{ID}-1$ which is a multiple of both $p-1$ and $q-1$; then from $N,f$ can efficiently factor $N$ using the algorithm detailed here; and then can computes $d_{ID}$ for any ${ID}$, and thus decipher the normal way.
2
It is easy to show that in RSA, when e = 3 there are 4 messages m for which the ciphertext is equal to the plaintext and gcd(m, n) = 1
Well, if $m^3 = m \pmod n$ (and assuming $n$ is a conventional RSA modulus, that is, it is $n = pq$, for $p, q$ distinct odd primes), this is equivalent to both of the below holding simultaneously:
$$m^3 = m \pmod p$$
$$m^3 =...
4
As of 2021, is RSA the only practical (i.e. safe, production-ready) option for asymmetric encipherment of symmetric keys at rest?
Of course not, there are a number of alternatives. For one, there is the Integrated Encryption Scheme, which can be used with either finite fields (e.g. modulo a 2048 bit prime), or over an elliptic curve. While not nearly as ...
-1
Before looking into PEM/ASN.1: EC private key is a prime field element, almost a bignumber. EC public key is a point on the curve, (most likely) encoded as two field elements, either prime-field (that is, modulo another prime) or binary extension field. So you look into curve description for background. Just pick two prime numbers for secp521r1 (from your ...
4
The private key data is encoded in ASN.1, so you need to decode that to get the various fields out. openssl asn1parse can do this, but by default it'll parse the "EC PARAMETERS" section of the file (since that comes before the "EC PRIVATE KEY" section), so you need to strip that off first. You can do that with sed, and then pipe the ...
0
It appears from the example that encryption and signature use some padding modes in PKCS#1; likely RSAES-PKCS1-v1_5 for encryption and RSASSA-PKCS1-v1_5 with SHA-256 for signature.
Is it possible to leak private key data?
As far as we know, no, the fact that it's deciphered a message and signed it with the same key can not leak private key data. That's ...
Top 50 recent answers are included