New answers tagged

2 votes

What happens if we know that for an RSA key pair, the equation $d^e \equiv c \pmod{n}$ holds?

As a complement to fgrieu's answer, here is an idea of the sort of issues that can occur. Let's say that $d$ is taken as the inverse of $e$ mod $\varphi(n)$ (it would work pretty much the same with $\...
Mehdi Tibouchi's user avatar
1 vote

What scheme is the best for combining two shared secrets?

As a rule of thumb, when you're combining two values, there's a risk if a simple relationship between the values can be observed in the combination. In your first two schemes, if ...
Gilles 'SO- stop being evil''s user avatar
4 votes
Accepted

Integrating Elligator mapping with libsodium Curve25519 implementation

Monocypher author here. First, I can confirm Elligator only needs the sign of the y coordinate… which by definition of X25519, is always "positive". This is not a good thing! You want ...
Loup Vaillant's user avatar
0 votes

What scheme is the best for combining two shared secrets?

One of the best tools for the job is a so-called dual-PRF. That is a pseudo-random function that is secure whether it's keyed normally or by the output. HMAC has been widely used as a dual PRF, ...
Marc Ilunga's user avatar
  • 2,858
0 votes

Static vs ephemeral diffie-hellman

I believe Perfect Forward Secrecy (PFS) provides protection against future key leaks. In static Diffie-Hellman (DH) exchanges, the server exponent remains constant. If this parameter is compromised, ...
Fernando Silva's user avatar
3 votes

What happens if we know that for an RSA key pair, the equation $d^e \equiv c \pmod{n}$ holds?

Reformulating: it's asked if disclosing the integer $c=d^e\bmod n$ compromises the security of an otherwise secure RSA public key $(n,e)$ with private exponent $d$. I'll assume $0<d<n$, as ...
fgrieu's user avatar
  • 138k
3 votes

Group for which computing inverse is hard

How about the multiplicative group $\mathbb{Z}_{\phi(n)}^*$, where $n=pq$ is an RSA modulus? Under the hardness of factoring, this is a hidden order group, and computing inverses in this group is as ...
Geoffroy Couteau's user avatar
0 votes
Accepted

How does FORS: Forest of Random Subsets work?

How FORS works is fairly simple. The signer selects $k$ lists of $2^a$ values each. For each such value $x_{c, d}$ (the $d$th item from the $c$th list), he computes the 'public' value $H(x_{c,d})$ (...
poncho's user avatar
  • 145k
1 vote

Is gcd(e,p−1)=1=gcd(e,q−1) similar to gcd(e,phi(n))=1?

If $n=p\,q$, and $p$ and $q$ are prime, and $p\ne q$, then $\varphi(p\cdot q) = (p-1)(q-1)$, from which it follows that for any integer $e$, the propositions $\gcd(e,p-1)=1=\gcd(e,q-1)$ and $\gcd(e,\...
fgrieu's user avatar
  • 138k
5 votes

All 32 bit primes on 1 640Mb CD-ROM , and then used as immediate lookup of resulting prime factors, is that even possible, in early 1990s?

The claim "all 32 bit primes on one 640 MByte CD-ROM by 1990" is entirely reasonable. There are $203{,}280{,}221<2^{27.6}$ primes of at most 32 bits (see OEIS A007053), and that fits a CD-...
fgrieu's user avatar
  • 138k
2 votes

All 32 bit primes on 1 640Mb CD-ROM , and then used as immediate lookup of resulting prime factors, is that even possible, in early 1990s?

32-bit primes only need about a little bit more than 800MB before compression: http://umopit.ru/CompLab/primes32eng.htm , 512-bit would probably be impossible, since we're still using 64-bit operating ...
DannyNiu's user avatar
  • 9,001
2 votes

All 32 bit primes on 1 640Mb CD-ROM , and then used as immediate lookup of resulting prime factors, is that even possible, in early 1990s?

Lookup from a CD is really really slow. Building a list of all 32bit primes in the early 90s very plausible, putting it on a CD? didn't count them, but sounds about correct. Using them as a lookup? ...
Meir Maor's user avatar
  • 11.7k
3 votes

RSA/ ECC keygen HW vs SW

Regardless of the physical protection provided by an HSM or TPM or any hardware cryptographic key storage system, are keys generated in hardware “higher quality” than those generated in software? ...
Maarten Bodewes's user avatar
  • 91.8k
2 votes
Accepted

Hybrid key exchange in TLS 1.3

How does this concatenation provide the simultaneous benefit of both classical and quantum at the same time? This proposal assumes the TLS 1.3 key derivation chain, where they perform an HKDF-Extract ...
poncho's user avatar
  • 145k
1 vote

Does higher key sizes correspond to a higher security parameter?

This can be either a philosophical question or a empirical question, but answer to both these sides can be similar. First, the title is correct, higher key sizes corresponds to a higher security level....
DannyNiu's user avatar
  • 9,001

Top 50 recent answers are included