New answers tagged public-key
5
You misunderstood something. HMAC-SHA-1 does not use SHA-1 as the signing algorithm. The signing algorithm is the HMAC-SHA-1 calculation, not an intermediate SHA-1 calculation. The signing algorithm takes the key and the message as inputs and produces the MAC value as output.
The usual terminology for the hash algorithm that an HMAC construction uses is “...
3
While this could be misleading, it is ultimately serving the same purpose here, just with a symmetric key instead of an asymmetric one. Just as an asymmetric signature provides proof of ownership of the private key, a MAC provides proof of ownership of the symmetric key.
Depending on how this key comes into existence this may provide varying levels of real-...
0
You could have a single pseudo-random function that is secret to you. To anyone else its computation at some value will look random. The reason we choose to have a public family of functions and a secret key is inspired by a principle known as Kerckhoff's Principle. Kerckhoff recognized that a compromised private encryption scheme (i.e your single private ...
5
Summary: finding $n$ from $(e,d)$ is computationally feasible with fair probability, or even certainty, for a small but observable fraction of RSA keys of practical interest, including with a modulus much too large to be factored.
I'll assume
unknown $n=p\,q$ with $p$ and $q$ unknown distinct large primes of comparable order of magnitude, say $\max(p,q)<...
5
In the normal setting $n=pq$ is public knowledge and $\varphi(n)$ is hidden, for a start.
I will assume $$ed\equiv 1 \pmod {\varphi(n)}\quad(1).$$
Since
$$\varphi{(n)} = (p - 1)(q - 1) = pq - p - q + 1 = (n + 1) - (p + q)$$
Also, $n = pq$ and some manipulation gives
$$n = p \left ( n + 1 - \varphi{(n)} - p \right ) = -p^2 + (n + 1 - \varphi{(n)})p$$
and then
...
2
The thing that makes subtle crypto almost entirely useless is the lack of key management. Although you seem to use the primitives in the correct way, the key management is not specified at all in your question.
If, for instance, you cannot trust the TLS connection, then what chance is there that the public key used for encryption is trusted? About none. ...
0
Note that in RSA, someone knowing the "decryption key" for any "encryption key" for a given modulus N can compute the "decryption key" for any "encryption key" for the same modulus. In other words, be careful when having $e₁$ and $e₂$ using the same modulus, if someone knows $d₁$ such as $1 = e₁ \times d₁ (\bmod \phi(N)...
1
Besides the answer Dimitree gave to himself, I' like to add something even if I am not sure whether I understand the original problem he wanted to solve.
You used the same message a and encrypted it with different values for e, but used the same modulus N. And you added the different exponents e.
As far as I know, the homomorphic multiplicative feature of ...
0
Needed to stay out of libgcrypt repository and instead remain focused within the higher level gnupg repository, specifically gnupg/g10/keyid.c. The keygrip_from_pk() function is what makes the public key algo specific calls to build the S expressions that feeds the lower level gcry_pk_get_keygrip() function used to calculate the binary keygrip array that is ...
0
Technical How
For RSA see https://en.wikipedia.org/wiki/RSA_(cryptosystem)#Key_generation
The distinct prime numbers are required to calculate n as well as for other steps in the process. Therefore separate seeds for p and q would be needed, because they should not be adjacent primes, but both random. Therefore it is infeasible to derive with "a random ...
1
How to derive a private/public keyset from a random seed?
In principle: seed a Cryptographically Strong Pseudo Random Number Generator with the random seed, and use it to generate the RSA key pair "normally". For the later, we could use FIPS 186-4 B.3.2.
Are there major security flaws with this approach?
Yes, the obvious one: any entity knowing ...
0
Normally CSR does not need to be secret. CSR is signed by the applicants private key. If an attacker intercepts a CSR, changes email address and sends CSR on CA, CA will reject it, because the signature will not match the content of the CSR. If the attacker signs the changed CSR with attackers private key, the signature will still be invalid, because it ...
1
After doing some digging, I think it may just be a matter of IND-CCA3 (see the end of this answer and this paper) being meant instead of the, perhaps usually implied, IND-CCA2. In particular, the specific use of asymmetric cryptography for authentication of the sender may be the sticking point.
When talking about encrypt-then-MAC, the mechanism by which the ...
5
I am not sure how the IND-CCA experiment in this case works.
Well, it doesn't really. There are no verification keys designated as such in the CCA experiment and there is no designated sender in the definition of a public key encryption scheme at all.
So, the only way to communicate to the receiver who supposedly encrypted a ciphertext would be to put it in ...
6
I would go further than fgrieu and say that in general you should not use (significantly) weakened cryptographic primitives for only time sensitive crypto, regardless of the time window.
Why?
Because there is nothing that guarantees hardness of any crypto. Mathematically the status quo is that we are generally have nothing more than 'a bunch of smart and ...
5
Well, it's good that you're trying to learn. However, learning from the original seminal papers does have some issues that you need to be aware of.
For one, sometimes the original authors did not anticipate some issues that later contributions found (and for which common practice adjusted for).
For example, it is now recognized that public key encryption ...
1
Yes. The general construction is called IES (Integrated Encryption Scheme), most often practiced as ECIES (elliptic curve IES). The principle is the same: use the “key agreement” primitive (DH, ECDH, X25519, …) to construct a secret that is shared by two parties, each of which knows both sides' public keys but only their own private key. The shared secret is ...
answered Jun 18 at 10:46
Gilles 'SO- stop being evil'
12.6k3 gold badges34 silver badges67 bronze badges
18
Let's assume I need to encrypt data only for one minute, after that time the data is useless. Couldn't I still use ECC2K-130 as it would require 525600 times more PlayStations to crack it in a single minute instead of a year?
!!! NO !!!
Decryption by an unauthorized party could occur within a fraction of a second following the release of the ciphertext.
In ...
2
You have enabled
Extension: extended_master_secret (len=0).
When the extended master secret extension is negotiated in a full handshake, the master_secret is computed as:
master_secret = PRF(pre_master_secret, "extended master secret",
session_hash)
[0..47];
0
I don't fully understand the notation in that link you posted, but as far as hashing the public key instead of signing it directly, some public keys are pretty long, making signing expensive. Public keys for RSA can be 4096 bits, which is too long for most signing schemes. Hashing the public key allows it to be signed more efficiently without losing security....
7
@hakoja correctly points out that what you are asking for is not compatible with CCA security (the security property that Cramer-Shoup satisfies). More specifically, you seem to be looking for a rerandomizable, RCCA-secure encryption scheme. These two properties mean:
Rerandomizable: Given an encryption of an unknown $m$, there is a way to generate fresh ...
6
Answering only your first question: no, that's not possible. Essentially, if it was possible to randomize the ciphertext of Cramer-Shoup, then it wouldn't be IND-CCA2 secure. However it is IND-CCA2 secure, so it cannot be re-randomizable.
3
If it's replaced by another function with the same length output, then I assume tweetnacl will use its output just as happily?
Yes, it seems to be a normal collision-resistant cryptographic hash function, replacing it by any other will not significantly alter the security properties (unless one of them is broken) but will of course break interopability.
In ...
0
Keygrips are not part of PGP at all, they're just an implementation detail of GnuPG's key storage architecture specifically (which uses a common key store for PGP, S/MIME, and SSH).
As you saw, GnuPG uses libgcrypt for cryptographic operations, and the keygrip calculation can be found in cipher/pubkey.c where it's just a SHA-1 hash of the public key's ...
Top 50 recent answers are included
