New answers tagged public-key
5
Lot of questions here. I try to break it down quite simple and answer your initial question.
What you have posted is a base64 encoding of an ssh-rsa public key. So its basically not really readable to humans. If you decode this string, you can have a look at it byte-wise. I will show you the first several bytes of your example, trying to explain what they ...
5
There are many scenarios in which asymmetric encryption cannot be replaced by hybrid encryption. At a high level, the common feature of these scenarios is that they exploit some algebraic property of the asymmetric encryption scheme, which a hybrid encryption method would break. This typically happens when we do not want to solely communicate data, but also ...
4
The specification mentions that the signature is per ECDSA on curve "P-256" (aka secp256r1), or RSASSA-PSS with a modulus of 2048 bits in combination with the SHA–256 hash (I guess with MGF1 with SHA-256; can't be sure for salt size). These are state-of-the-art, unbroken algorithms.
I find it unbelievable that a cryptographic attack would let emit ...
2
There are several compilers that take a CPA-secure PKE and produce a CCA-secure PKE. I am aware of two.
The first (possibly the earliest) is the Naor-Yung transformation [NY], which uses a non-interactive zero-knowledge proof (NIKZ) for this purpose. Since we know how to construct NIZKs from a variety of hardness assumptions (e.g., quadratic residuosity, LWE ...
1
I don't believe so. The two concepts are related to fading channels with continuous noise and how fast certain iterative decoding algorithms converge. I cannot think of a relevance to code based cryptography.
0
The encryption of the key has nothing to do with RSA.
Cracking it is as hard as cracking every other encrypted stuff using the same encryption algorithm (not RSA, because it would be encrypt symmetrically with something like AES).
Best you can do is bruteforcing the password and hope it is a weak one.
No magic here.
3
Yes, it is even possible without interaction (nothing Bob needs to send to Alice). The method is called "ring signature".
Let's say she wants to sign a message like "I am Alice an hereby proof to Bob that I know one of the keys".
She hashes it to get $m$.
Alice now generates a random value $r_i$ for every public key $k_i$ and encrypts ...
2
Here is a proposal (out of my head). Big picture
Bob draws a random $X$, and sends it deterministically enciphered under each public key
Alice deciphers $X$ with the public key she holds
Alice checks Bob did as expected given that $X$
Alice reveals $X$ to Bob
More precisely:
Define a $8b$-bit hash (say SHA-512) such that $\min(n_i)>2^{16b}$
Define a ...
0
I haven't found out how to set the parameters in such a way that the security level is consistent.
The problem is that they can't be consistent; secret sharing will always score better on "cryptographical security" than Pallier, no matter what parameters you use.
With Pallier, if you have the ciphertext and the public key, one could recover the ...
2
Just want to make sure that my understanding is correct whether there is only one public key for any private key, and vice versa.
That is not correct; formally, for any valid private RSA key, there are an infinite number of public keys that will work with it, and for any valid public RSA key, there are an infinite number of private keys that will work with ...
5
So, I’m wondering how much data can be verified by an electric signature?
If you're asking about how much data that a single public key signature can handle, well, there's no realistic limit.
What every signature system (at least, every one that I've heard of) does is take the message, pass it through a hash function to generate a short hash (and then ...
1
If it does matter, what is the current state of the art elliptic curve and how does it compare with popular elliptic curves such as Curve25519 or secp256k1?
Well, if you have an elliptic curve with a large subgroup of size $q$ (which is prime), then we know how to compute a discrete log within that subgroup in $O(\sqrt{q})$ time, and this applies to all ...
1
From the documentation:
The crypto_box function encrypts and authenticates a message m using the sender's secret key sk, the receiver's public key pk, and a nonce n.
So the secret key (actually a private key, but that has the same acronym) is used for authentication. If you use a ephemeral (what you call "throwaway") key pair then you forgo ...
0
I think you are misunderstanding the way NaCl boxses work. NaCl encryption like you are doing it uses two algorithms. One symmetric one and another asymmetric. Specifically XSalsa20 (symmetric) and Curve25519 (asymmetric).
The way it works is as follows:
Curve25519 allows the generation of a shared 32 byte key given a public key and private key.
So basically ...
5
To supplement the generic answer, here's a concrete construction based on ElGamal.
ElGamal based on a group $G$ of order $p$ with generator $g$ has a public key $y = g^a$, where $a$ is the private key.
To create a new public key, choose a random number $s$ and compute $(u,v)$ as $u=g^s$ and $v=y^s$.
To encrypt $m$ with $(u,v)$, choose a random number $r$ and ...
15
Such a scheme can be created generically, as follows. Let $(Gen,Enc,Dec)$ be a public-key encryption scheme, and let $F$ be a pseudorandom function. Then, the "master" private key of the scheme is a symmetric key $k$ for the PRF. In order to generate a new public key, choose a random $\rho$ (or if you have state then use a counter) and compute ...
Top 50 recent answers are included
