New answers tagged public-key
3
if I use $e=7$ (or another coprime like $11$) I can't compute $d$
You can use $e=7$. When $n$ is squarefree, a private exponent $d$ will work if (not: only if) $e\;d\equiv1\pmod{\phi(n)}$, that is by definition when $e\;d-1$ is divisible by $\phi(n)$. There are solutions to that if and only if $e$ is coprime with $\phi(n)$. The textbook systematic way to ...
1
Why use symmetric encryption with Public Key?
The scrambling in public-key encryption systems is often limited to very specially chosen inputs.
For example, RSA with modulus $n$ is good at scrambling uniform random integers between $0$ and $n$, but bad at scrambling random English text. In contrast, the stream cipher ChaCha can securely encrypt any bit ...
0
An analogy that I find helpful for newer people is to think of the:
Symmetric algorithm as a physical key and an associated "symmetric type of" safe
Asymmetric algorithm as both
an open padlock (your public key) that also has an associated "asymmetric lockbox"
the physical key that unlocks the padlock (associated private key)
The Password Based Key ...
2
Am I wrong? (where?)
Yes, there is a small mistake in the way you are computing $d$: you need to compute $d$ as being the inverse of $e$ modulo $\phi(n) = (p-1)(q-1) = 60$. So, if you pick $e= 7$ (since you cannot pick $e = 3$ because it would be coprime with $\phi(n)$), you need to compute its inverse modulo (which is typically done using Euclid's ...
0
asymmetric encryption is not available; e.g. due to large data size
Besides having bigger ciphertext representation, it's also proven to be slower than enciphering data with symmetric schemes. But recall that digital signatures are also available to perform verification.
symmetric keys are available but you do not want them to be shared with other ...
2
I think you're looking for Hybrid cryptosystems.
As you correctly noted it's not only unsafe to encrypt large data with a asymmetric system it's also very slow compared to symmetric systems. That's why we usually use both of these systems together (hence hybrid) to "fill each other's gaps".
We share a symmetric key using asymmetric cryptography. The ...
0
The RSA paper is giving a simple argument in their IX-B section;
Computing $\phi(n)$ Without factoring $n$
An attacker who can compute the $\phi(n)$ then he can break the system by computing the inverse of $d$ of $e$ modulo $\phi(n)$.
They argue that finding $\phi(n)$ is not easier than factoring since it will enable factoring as follows;
$(p+q)$ can be ...
1
If a public-key encryption scheme is CPA-secure is it also secure in this revised version of CPA game?
Yes, because this is essentially a trimmed down version of Left-or-Right-CPA security (PDF) which is provably equivalent to the first definition you mentioned which is also known as Find-Then-Guess-CPA security.
If your scheme is LoR-CPA secure then you ...
2
A universal one-way hash function (or UOWHF), also known as a target-collision-resistant (or TCR) hash function, is a randomized hash function $H_r(m)$ with the following security: If an adversary commits to a message $m$, then upon being challenged with a random $r$, the adversary cannot find a distinct message $m' \ne m$ such that $H_r(m) = H_r(m')$. (...
0
The CC2650 is a Cortex M3 with 128KB flash memory and 20KB SRAM.
This is definitely not enough for RELIC or OpenSSL.
TinyECC fits, but even if this is only for signatures, some symmetric cryptography will be needed in addition to it.
Better options would be Cifra, libhydrogen, tweetNaCl or a minimal BearSSL build. They all fit in about 20 KB flash memory ...
0
You should pick a key-based key derivation function, such as HKDF-SHA256. Then:
Generate a master key $k$ uniformly at random.
Derive an Ed25519 seed $k_0$ from it by $$k_0 = \operatorname{HKDF-Expand}_k(\text{info=‘Ed25519 signing key’},\, \text{size=32 bytes}).$$
Derive an AES key $k_1$ from it by $$k_1 = \operatorname{HKDF-Expand}_k(\text{info=‘AES ...
1
..how does this formula $(aG+bG) = (a+b)G$ work in ECDSA?
Perfectly well. It follows from the definition of $kG$ as $\overbrace{G+\cdots+G}^{k\text{ times}}$, associativity and commutativity of point addition. Notice that operator $+$ in $(aG+bG)$ and $G+\cdots+G$ is elliptic curve point addition, while operator $+$ in $(a+b)$ is addition in $\Bbb Z$ (...
0
How does this formula work (aG+bG)=(a+b)G in ECDSA?
This is due to the definition of scalar multiplication of Elliptic Curves.
$$[a]g = \overbrace{g+\cdots+g}^{{a\hbox{ - }times}}$$
$$[b]g = \overbrace{g+\cdots+g}^{{b\hbox{ - }times}}$$
then $$[a+b]g = \overbrace{g+\cdots+g}^{{a+b\hbox{ - }times}} = \overbrace{g+\cdots+g}^{{a\hbox{ - }times}} + \overbrace{...
1
The key point in RSA is the fact that inversion in modulo $|G|$ is hard, of course other groups are a priori okay to build a secure encryption scheme.
For example $U_{pqr}$, with $p, q, r$ large primes seems to be okay. But it will be probably less efficient (keys and ciphertexts will be probably larger for the same level of security).
Of course, it is not ...
5
Signing the public key is safe.
The general assumption is that the adversary is allowed to ask any message that he knows to be signed, and that operation must not leak information about the private key (or otherwise generate a signature for a message that was not signed by the legitimate signer).
In this model, the adversary knows the public key (it's ...
1
Answering my own question. I believe it is possible. We can use the scheme by Boneh et al. described here.
It uses pairing-based cryptography to be able to create a searchable, asymmetric, tagging scheme. In this scheme, queries are made through a trapdoor of the real key that we want to search, making it impossible for the set holder to retrieve ...
5
Question #1:
Is there any institution or government in the present implementing for example NTRU, SIKE or multivariate crypto schemes on their communication establishment to prevent past private information recovery?
Answer:
Currently the Open Quantum Safe (OQS) project has been launched to support the development and prototyping of post-quantum ...
4
First, we'll assume that $n_B > n_C$, and we'll assume that he has no knowledge of the plaintext messages (which, if $A$ uses randomized padding, which he ought, is an appropriate assumption, even if the adversary knows the text of the message).
Then, if any of the 12 messages $\mathit{ciphertext}_i \ge n_C$, then he knows that message cannot be to $n_C$ ...
5
Short answer: You could do this, but (a) it would be dramatically more expensive, (b) it would not improve security in the way you think it would, and (c) it would by design have back doors.
Every now and then, we read that some hashing function has been weakened or broken, but we almost never hear this for asymmetric cryptosystems like RSA or ECC. That's ...
2
What happens after sharing the secret key in quantum cryptographic schemes to send the message bits?
The actual "process upto which the quantum key is shared securely" is nontrivial from an information theoretic perspective, to the point that few people understand it fully (I don't), and some do not even realize that prerequisites include a shared secret. See sections A and B in this for an overview, and section E.1 for why we should take the security ...
1
The SOG-IS Agreed Cryptographic Mechanisms, which incorporates many elements from the French RGS, states (§4.1):
Note 28-SmallD. The size of $d$ should be close to the size of $n$. Note that this is guaranteed for a small $e$. We should have at least $d > 2^{n/2}$, where $n$ denotes the bitlength of the modulus.
This is the usual advice which has been ...
answered Oct 23 at 11:57
Gilles 'SO- stop being evil'
11.3k3 gold badges31 silver badges62 bronze badges
2
I was told that you can determine the private key of an RSA encryption with the public key. Were they joshing me or can it be done?
Yes, it can be done. What you have not been told is that to factor a public key (usually hundreds of digits) to find the private key, requires a time exponential in the length of the public key,
therefore even a supercomputer ...
Top 50 recent answers are included
