New answers tagged public-key
2
votes
What happens if we know that for an RSA key pair, the equation $d^e \equiv c \pmod{n}$ holds?
As a complement to fgrieu's answer, here is an idea of the sort of issues that can occur.
Let's say that $d$ is taken as the inverse of $e$ mod $\varphi(n)$ (it would work pretty much the same with $\...
- 2,115
1
vote
What scheme is the best for combining two shared secrets?
As a rule of thumb, when you're combining two values, there's a risk if a simple relationship between the values can be observed in the combination. In your first two schemes, if ...
4
votes
Accepted
Integrating Elligator mapping with libsodium Curve25519 implementation
Monocypher author here.
First, I can confirm Elligator only needs the sign of the y coordinate… which by definition of X25519, is always "positive". This is not a good thing! You want ...
0
votes
What scheme is the best for combining two shared secrets?
One of the best tools for the job is a so-called dual-PRF. That is a pseudo-random function that is secure whether it's keyed normally or by the output. HMAC has been widely used as a dual PRF, ...
- 2,858
0
votes
Static vs ephemeral diffie-hellman
I believe Perfect Forward Secrecy (PFS) provides protection against future key leaks. In static Diffie-Hellman (DH) exchanges, the server exponent remains constant. If this parameter is compromised, ...
3
votes
What happens if we know that for an RSA key pair, the equation $d^e \equiv c \pmod{n}$ holds?
Reformulating: it's asked if disclosing the integer $c=d^e\bmod n$ compromises the security of an otherwise secure RSA public key $(n,e)$ with private exponent $d$. I'll assume $0<d<n$, as ...
- 138k
3
votes
Group for which computing inverse is hard
How about the multiplicative group $\mathbb{Z}_{\phi(n)}^*$, where $n=pq$ is an RSA modulus? Under the hardness of factoring, this is a hidden order group, and computing inverses in this group is as ...
- 19.1k
0
votes
Accepted
How does FORS: Forest of Random Subsets work?
How FORS works is fairly simple.
The signer selects $k$ lists of $2^a$ values each. For each such value $x_{c, d}$ (the $d$th item from the $c$th list), he computes the 'public' value $H(x_{c,d})$ (...
- 145k
1
vote
Is gcd(e,p−1)=1=gcd(e,q−1) similar to gcd(e,phi(n))=1?
If $n=p\,q$, and $p$ and $q$ are prime, and $p\ne q$, then $\varphi(p\cdot q) = (p-1)(q-1)$, from which it follows that for any integer $e$, the propositions $\gcd(e,p-1)=1=\gcd(e,q-1)$ and $\gcd(e,\...
- 138k
5
votes
All 32 bit primes on 1 640Mb CD-ROM , and then used as immediate lookup of resulting prime factors, is that even possible, in early 1990s?
The claim "all 32 bit primes on one 640 MByte CD-ROM by 1990" is entirely reasonable. There are $203{,}280{,}221<2^{27.6}$ primes of at most 32 bits (see OEIS A007053), and that fits a CD-...
- 138k
2
votes
All 32 bit primes on 1 640Mb CD-ROM , and then used as immediate lookup of resulting prime factors, is that even possible, in early 1990s?
32-bit primes only need about a little bit more than 800MB before compression: http://umopit.ru/CompLab/primes32eng.htm , 512-bit would probably be impossible, since we're still using 64-bit operating ...
- 9,001
2
votes
All 32 bit primes on 1 640Mb CD-ROM , and then used as immediate lookup of resulting prime factors, is that even possible, in early 1990s?
Lookup from a CD is really really slow.
Building a list of all 32bit primes in the early 90s very plausible, putting it on a CD? didn't count them, but sounds about correct. Using them as a lookup? ...
- 11.7k
3
votes
RSA/ ECC keygen HW vs SW
Regardless of the physical protection provided by an HSM or TPM or any hardware cryptographic key storage system, are keys generated in hardware “higher quality” than those generated in software?
...
- 91.8k
2
votes
Accepted
Hybrid key exchange in TLS 1.3
How does this concatenation provide the simultaneous benefit of both classical and quantum at the same time?
This proposal assumes the TLS 1.3 key derivation chain, where they perform an HKDF-Extract ...
- 145k
1
vote
Does higher key sizes correspond to a higher security parameter?
This can be either a philosophical question or a empirical question, but answer to both these sides can be similar.
First, the title is correct, higher key sizes corresponds to a higher security level....
- 9,001
Top 50 recent answers are included