New answers tagged public-key
1
I spent about 400 hours in paint to make an illustration of this, hope it helps!
7
You can't have two different public keys for the same RSA private key. That's just not how RSA works.
Well, almost. There's a minor technical loophole, and it's the fact that RSA has equivalent keys. In particular, the public keys $(n, e)$ and $(n, e + \lambda(n))$ are equivalent, in the sense of producing the same ciphertext for the same (padded) ...
3
Although PKCS1's ASN.1 is a quite common representation of RSA keys, it is not the only one used (and certainly not the only one possible).
The standards for XML digital signature and encryption unsurprisingly use XML not ASN.1 for data structure: https://www.w3.org/TR/xmldsig-core1/#sec-RSAKeyValue
The standards for JSON Web Signature and Encryption (...
2
How do we pick a group size for a 128-bit security level?
Estimate the cost of mounting an attack as a function of the group size.
Find the group size that puts that cost estimate above $2^{128}$.
In this case, for appropriately selected groups, without back doors, like the RFC 3526 groups, the best attack algorithm is the general number field sieve, GNFS. ...
1
In short
If the scheme is at least CPA-secure, then it is safe to encrypt and send the same message to different parts as you described.
Long answer
In the CPA-security game, the attacker has the ability of encrypting a $poly(\lambda)$ messages, which may even be the same message, and then it is still hard to distinguish two ciphertexts.
Therefore, an ...
1
There's a wide gap between plaintext recovery and key recovery. Of course, what is of interest to users is the confidenitality of their plaintext, but if an attacker can merely recover a single plaintext (which might happen outside the domain of crypto if the user just leaves it on the tube on their way to work!), that doesn't mean they can recover the next ...
3
Logjam is a two-step process. First, you take a group and apply a precomputation to it. Most people use one of a few different groups, so breaking a single group effectively breaks every single key exchange done by anyone using that group. If a group is "broken", then any key exchange done with Diffie-Hellman using that group can be broken quite easily, ...
0
Here's how to recover $e \bmod 37^2$:
Pick a random plaintext $m$, and use the oracle to obtain $c = c^e \bmod n$
Compute $m_p = m^{(p-1)/(37^2)} \bmod p$ and $c_p = c^{(p-1)/(37^2)} \bmod p$
If $m_p^{37} = 1$, then try again with a different random plaintext; this is to eliminate plaintexts that don't give you as much information as they could; if you ...
0
E3kit uses ECIES under the hood. It's a hybrid encryption scheme where symmetric key is encrypted using the key derived from the DH shared secret. KDF is needed because it's not secure to use the raw DH result as a symmetric key.
0
Forward secrecy is about protecting previous sessions if long-term secrets are later compromised.
A random session key does not necessarily provide forward secrecy. An example of this is the "traditional RSA" ciphersuites in SSL/TLS. The client generates a random shared secret for the session, encrypts it with the server's long-term RSA public key and ...
2
The term ‘perfect forward secrecy’ is bad. Rather than talking about whether a protocol has perfect forward secrecy, you should talk about when in the protocol you erase keys. Then, although ‘key freshness’ isn't a common technical term in cryptography, this suggests a clear answer:
Key freshness is presumably about when you generate new keys so that ...
3
As pointed out in the comments, this allows for a small and negligible number of weak keys which can be avoided.
Let us not forget that this pioneering paper was published before any examples of public key cryptosystems were known in the open literature. The authors took the astute position that if good cryptosystems were discovered, a few weak keys should ...
1
How large can RSA and DLOG keys be before the standard gives up?
In theory, they can be indefinitely long using some implementation adaptions. However, they would become too impractical compared to post-quantum algorithms which do not require such key lengths that no one will use them.
Is it reasonable to assume $10^9$ bit keys are possible with next ...
2
Also Can it be prevented If I store the Public key in a certificate store?
Well, an adversary could probably just overwrite that entry and mount the same attack as before.
Now I have a problem, what if someone's signs the license file content with entirely new set of private\public key pair.
What you have stumbled across is the "trust problem" of public ...
0
This is standard key sharing mechanism taking place in various applications. For encrypted two way communication, the client and server need to have a shared secret key. So a key has to be first shared before the secure communication can take place. Now how can the key be shared?
Here the PKI helps. The SNI server has released its public key which can be ...
1
Is Public key used directly to encrypt a message or it is used to derive other keys?
A public key is used to encrypt a message.
Example:
If Alice wants to send a message to Bob she would take Bob's public key and encrypt the message and send the encrypted message to Bob.
A key to derive other keys is done with a Key derivation function and this key is ...
4
Do (should) services where the customer has to provide a public key,
check this public key for weaknesses? What kind of weaknesses could a
key be tested for?
I'm pretty sure that there's no easy way to find out if a public key has been generated safely without some sort of brute-force attack.
Ultimately I think it's up to the creator of the public key ...
1
To understand how nonces and timestamps are used to prevent a replay attack, you must understand generally what a replay attack is. A replay attack is a network attack in which a data transmission (that is valid) is repeated or delayed. An attack like this is usually done by an adversary who happens to intercept this data and re-transmits it.
If Alice (...
0
I see four ways how to attack this scheme
1) RSA malleability
Suggested in comments
2) If $e=3$ then
Trivial attack exists. Hint: What is the minimal possible size of $N$?
3) If the attack is active(MiTM)
Cheaper attack exists. Hint: Treat the task as a set of Oracles:
$Oracle0: n \mapsto E(n)$ - If you know $(e,N)$, you can encrypt any $n$.
$Oracle1: \...
0
After looking a bit more into it I found a solution which I think should work.
I combined ECDH with AES todo the following:
Message Generation
I generate a new Elliptic Curve key pair (sesPk, sesSk)
I generate a key for each receiver: key_i = ECDH(sesSk, receiverPk_i)
I generate a message for each receiver: msg_i = AesEnc(key_i, sesSk||secret)
I combine ...
1
Is it possible to use any method for such a large list of compressed public keys in order to finally find at least one private key?
Actually, for ECC, it turns out that the problem 'given this long list of public keys, find any one private key' is no easier than 'given this public key, find the private key'
The proof is the converse; suppose we had a way, ...
0
This is not possible, an EC private key for the secp256k1 curve is (almost) 256 bits of random data. Brute forcing such a large value is impossible even if you have oodles of public keys. The skeptics in that forum thread are correct, BitCoin would be broken if this was possible.
15 million is only $2^{23}$ while you have a key space near $2^{256}$; the ...
Top 50 recent answers are included
