Questions tagged [rsa]

An asymmetric (e.g. public-key) cryptosystem, based on modular exponentiation with big exponents and modulus. RSA can be used both for signature and encryption with proper paddings.

Filter by
Sorted by
Tagged with
0 votes
1 answer
84 views

Prove RSA scheme is insecure

Im reviewing my crypto and I would like to prove the following: RSA experiment where the adversary is given (N, e, y) where N = pq and p, q are two primes. The adversary knows p, q. How can I build an ...
Jaxon Steinhower's user avatar
2 votes
1 answer
188 views

Can we use several times the same RSA and ECC keys?

For RSA or elliptic cryptography, can we use the same public/private keys for several exchanges, or is that unsafe? Does it lower the security of the protocol? To me it doesn't matter, as receiving ...
Wheatley's user avatar
  • 145
0 votes
1 answer
108 views

Clarifying terms for cipher, algorithm, rsa, asymmetric, openssl

I am a self taught front-end developer and I am just trying to get my cryptography terminologies straight. I will make some statements. Can someone correct my mistakes? Question 1 I read that cipher ...
learningtech's user avatar
2 votes
0 answers
205 views

How could a 1024‒bits RSA modulus be most economically factored within months today?

Of course this is a question with an answer that is due to evolve. A 2002 paper about TWIRL stated that the cost would be around 10M\$ and an other 10M\$ to manufacture the device. A later 2007 paper ...
user2284570's user avatar
3 votes
2 answers
98 views

RSA given 30% MSB of p and 30%MSB of q

is factoring RSA given 30% MSB of p and 30%MSB of q possible in polynomial time? Notice that it is known that given 50% MSB of p or q it is doable in polynomial time using Coppersmith's theorem
Don Freecs's user avatar
0 votes
2 answers
95 views

Is it possible to perform reverse rsa encryption ? (using the public key for decrypting and the private key for encrypting)

Simple question, but I couldn’t find an answer as I know about signing but don’t want it. The aim would be to encrypt someone’s bet parameter as a short message using the private key and use the ...
user2284570's user avatar
0 votes
1 answer
98 views

What exactly is RSA_WITH_AES256_CBC_SHA256?

Quick disclaimer, I am pretty new to cryptography. I only understand the basics of asymmetric and symmetric encryption. In particular, RSA and AES. I have a project where my service is receiving an ...
Aurelian Milleram's user avatar
3 votes
1 answer
207 views

Implications of switching RSA padding schemes

In my company we want to switch from PKCSv1.5 to PSS for RSA signing. This is because of the marvin attack vector. My question is, if an adversary can see many similar messages that were signed with ...
whomaniac's user avatar
  • 133
6 votes
1 answer
359 views

RSA with 3e≡1 (mod p−1) and 5e≡1 (mod q−1)

Consider RSA with $p$ and $q$ large distinct secret safe primes in interval $\bigl(2^{(n-1)/2},\,2^{n/2}\bigr)$, and private key $(N,e,d,p,q,d_p,d_q,q_\text{inv})$ computed as $$\begin{align} N&=p\...
fgrieu's user avatar
  • 140k
1 vote
0 answers
94 views

Different public keys $(e_i,N_i)$ but same decryption exponent $d$

We are given a number of distinct RSA public keys $(e_i,N_i)$ sharing the same unknown decryption exponent $d$. The $e_i$ were computed from $d$ drawn first, so we have different public keys. Can we ...
Pyp's user avatar
  • 11
1 vote
1 answer
191 views

Could FIPS 186-5 A.1.6 method generate P and Q with different bit size?

refers to FIPS 186-5 document, I have a question about RSA Key generation A.1.6 method, "Generation of Probable Primes with Conditions Based on Auxiliary", my understanding is that, this ...
gx16's user avatar
  • 45
0 votes
2 answers
119 views

What efficiency can we expect from an average consumer computer for the RSA algorithm?

I am trying to implement the RSA algorithm using the C language, for learning purpose. I was wondering how much time should we expect it to take for encrypting a message of size 1024/2048/4096bits on ...
Wheatley's user avatar
  • 145
1 vote
1 answer
76 views

How does the security of RSA compare to a symmetric cipher when both public and private keys are secret?

When RSA is used in a fashion where both the private key and the public key are both secret (for example, when the public key in a KEM is never leaked) could RSA be then evaluated as a symmetric ...
Jackie Lanhorn's user avatar
0 votes
1 answer
79 views

ROCA with unknown M and g [duplicate]

Trying to upsolve "notsosmart - hxp CTF 2017" https://2017.ctf.link/internal/challenge/5c8119ca-bfed-444a-968d-1cc9bff27bfb.html This server code was given during the CTF, letting you get ...
akonzu's user avatar
  • 57
1 vote
0 answers
96 views

Number of elements in cyclic group that satisfy an exponent

I'm having trouble with solving the following question: Given two distinct prime numbers $p, q$ where $(p-1)$ and $(q-1)$ are not divisible by $3$, define $n=pq$. For how many elements in $\mathbb Z^*...
Eatay Mizrachi's user avatar
6 votes
2 answers
351 views

RSA signatures without padding by using XOF output in range [1, n-1]

RSA signatures are implemented by encrypting the padded hash with the private key. Why not take the approach RSA-KEM is using by removing the padding entirely and replacing the hash with a XOF that ...
Jackie Lanhorn's user avatar
0 votes
0 answers
28 views

The Second Attack on Prime Power RSA using Two Decryption Exponents?

in this paper https://eprint.iacr.org/2015/399.pdf how to make the lattice?
happySu's user avatar
4 votes
1 answer
92 views

Is Bypassing Padding Verification in RSA-PSS Dangerous?

I am currently working on a project involving RSA-PSS (Probabilistic Signature Scheme) for digital signatures. While researching potential vulnerabilities, I came across the well-known Bleichenbacher ...
user113612's user avatar
1 vote
1 answer
142 views

Differences between two RSA signatures using OpenSSL

I want to sign a file called data.txt and store its signature in data.txt.sig. To create the signature, I want to use an ...
Allgaeuer's user avatar
  • 123
1 vote
1 answer
113 views

Proving that $\operatorname{parity}(c) = \operatorname{loc}(c \cdot \operatorname{Enc}(2^{-1}))$

I am studying the Goldwasser, Micali, Tong theorem about information leakage in RSA. In every book I have searched, there is the following remark $(c = \operatorname{Enc}(x))$: Note that $\...
Giorgos Mitropoulos's user avatar
2 votes
0 answers
54 views

Cryptographic accumulator via function composition

I am looking for an alternative to RSA accumulators, and I am wondering if the following option based on function composition might fit the bill. It seems like an obvious tweak on RSA accumulators, ...
Carson Farmer's user avatar
-3 votes
3 answers
150 views

Can a very efficient RSA factoring algorithm be worth money?

If someone had a very efficient RSA factoring algorithm, would a company or government entity be willing to purchase it? What factoring time would be considered fast, months, days, hours, minutes? ...
steveK's user avatar
  • 1
0 votes
1 answer
31 views

Threshold signature scheme for centralized group broadcast

I am looking for a threshold signature scheme (or similar proposals are happily accepted) that suits the following scenario: One Base Station is transmitting signed broadcast message to all members in ...
Tom's user avatar
  • 101
8 votes
1 answer
3k views

Are RSA signatures distinguishable from random data?

In the spirit of Are curve secp256k1 ECDSA signatures distinguishable from random data? Are RSA signatures distinguishable from random data? What if you don't know the message? What if you have many ...
Mark Omo's user avatar
  • 189
0 votes
1 answer
165 views

Encrypting large files using RSA and AES-256-CBC-HMAC-SHA256

I developed an application that stores large files. Those files are stored in plain text. Now the project owner wants those files be encrypted on storage, he wants confidentiality, integrity, and ...
Jesús López's user avatar
0 votes
1 answer
114 views

Is there a benefit in cryptography to return 0 in square and mutliply algorithm when a modulo is 0?

When a modulo is 0, the result of squaring or multiplying modulo will always be 0 as well. Therefore the loop could break and return 0. It can be a mean to compute faster the result of square and ...
Christophe Brun's user avatar
0 votes
1 answer
85 views

Looking for a modifiable signature!

I am a graduate student and have encountered some problems in my research. When I generate a signature on the data block of the file, and the signature is composed of the user's private key, the data ...
nan gan's user avatar
0 votes
1 answer
50 views

Compute a proof for a verifiable delay function

I am trying to solve the following problem: Alice generates a RSA key $(n, \phi)$, she shares with Bob the value $n$, and $y = g^{2^{t}}\;\text{mod}\; n$ for $g$ a generator of the group $\left(\...
Kroki's user avatar
  • 111
0 votes
0 answers
27 views

Finding plain text given two cypher texts of the same plain text with two diffrent public keys

I want to find the plain text from two cyphertexts of RSA, encrypted with two diffrent public keys. I know that: for E((n,e),m) = c0 and E((n,f),m) = c1 , c0^x . c1^y mod n = m mod n = m (ex + fy=1) ...
dskrby's user avatar
  • 1
1 vote
1 answer
110 views

Why are the primes all the same size in pqRSA?

pqRSA is MP-RSA with 4096-bit primes to build up a modulus of up to 1TB. If the objective is to make processing the modulus as expensive as possible for the quantum computer why not use just two 4096-...
user avatar
3 votes
2 answers
1k views

RSA key generation with large random numbers and no primality testing

Does the security of RSA rest entirely on the modulus having at least 2 large random primes? Suppose you were to generate 2 random 1,000,000-bit numbers and just use the product of those as the ...
user avatar
1 vote
1 answer
55 views

Who invented asymmetric cryotography [closed]

I am reading a book about blockchain. It said the asymmetric cryptography was invented by Whitefield Dime and Martin Herman in 1976. But I cannot find these two guys. Furthermore, what I know was RSA ...
Quant's user avatar
  • 13
1 vote
0 answers
82 views

Time-memory tradeoffs in RSA Meet-in-the-Middle attack

We assume a standard secure RSA public key $(n,e)$, e.g. 3072-bit $n$ and $e=65537$. The Meet-in-the-Middle attack (not to be confused with Man-in-the-Middle attack) on textbook RSA recovers $m$ from $...
fgrieu's user avatar
  • 140k
2 votes
2 answers
303 views

RSA: Is padding necessary for key exchange?

When RSA is strictly used to exchange random shared secrets, is the padding scheme important for security or can it be omitted entirely? The party in possession of an RSA public key will generate ...
user avatar
0 votes
1 answer
138 views

Is a prime shifting method for RSA modulus generation safe?

I have a prime number, $p$, with $n$ bits. To generate a new prime number, $q$, I shift the bits of $p$ from left to right by a certain length. For example, if $p$ is represented as ...
Lisbeth's user avatar
  • 497
2 votes
1 answer
80 views

1-out-of-2 Oblivious Transfer with RSA

I'm trying to implement a simple 1-out-of-2 Oblivious Transfer with RSA. I was checking the code and tried to work it step by step. The 2 messages by Alice, let's say, are $m_0 = 7$ and $m_1 = 9$. Bob'...
Guest's user avatar
  • 21
3 votes
2 answers
541 views

RSA perfect square phi

So I've been learning about RSA for quite a while (mainly by playing around in CTF competitions) and I came across an interesting problem. The other day I was looking to create a challenge in which I ...
Anonymous's user avatar
0 votes
2 answers
87 views

Cannot get RSA encrypt and decrypt to work in hardware and online calculator

I am attempting to get a hardware implementation of RSA working but I am having trouble with encryption and decryption. First, I ran these commands to generate the keys: openssl genrsa -out private-...
Jordan Krim's user avatar
2 votes
2 answers
791 views

In RFC 2313 (PKCS1/RSA) said you could recreate the Private key from 'n' and 'd', which later versions removed. Why?

RFC 2313 has this specific callout: ...
rip...'s user avatar
  • 123
0 votes
1 answer
123 views

Possible to encrypt message without knowing recipient public key?

Assume Bob is sender and Alice is future recipient. In ideal situation Bob know Alice public key, and encrypt message with it. But what if Bob don't know Alice public key (he only will know Alice ...
byXrom's user avatar
  • 3
0 votes
1 answer
94 views

Prove that if $e.d \equiv 1 \text{ mod } pq$ then it's impossible to have $e.d \equiv 1 \text{ mod } (p-1)(q-1)$

I am studying RSA cryptosystem and here is the question that came to my mind. Let's pick $p, q$ to be two primes and $n = p * q$. From that we calculate Euler's totient function: $$ \phi(n) = (p - 1)(...
QuestionEverything's user avatar
3 votes
2 answers
86 views

What happens if we know that for an RSA key pair, the equation $d^e \equiv c \pmod{n}$ holds?

If we possess the knowledge that the expression $d^e \equiv c \pmod{n}$ holds for an RSA key pair, what would be the implication or consequence of this? Here, $e$, $n$, and $d$ represent the public ...
Lisbeth's user avatar
  • 497
0 votes
2 answers
127 views

Chinese Remainder Theorem in a strange configuration

Normally, the chinese theorem looks like this:$$ x = a_1 \bmod n_1\\ x = a_2 \bmod n_2\\ x = a_3 \bmod n_3$$ but what to do if in my situation it looks like this:$$ c_1 = x^e \bmod n_1\\ c_2 = x^e \...
vert3x's user avatar
  • 1
0 votes
2 answers
330 views

Are Safe and Sophie Germain primes evenly distributed?

Do Safe and Sophie Germain primes maintain a relatively stable distribution as numbers get larger, or do they become rarified beyond a predictable value? This is important in one area of triangular ...
Zekchelovek's user avatar
3 votes
3 answers
352 views

"crandall" - unsolved CTF challenge - ASIS-quals-2023

...
akonzu's user avatar
  • 57
0 votes
0 answers
80 views

Textbook RSA on random numbers mod a smaller prime

I have a protocol where I have a random one-time number message $m \in \mathbb{Z}_p$, where $p$ is a 256 bit prime from an Elliptic Curve (EDIT: The order of an elliptic curve prime order group). I ...
Zarquan's user avatar
  • 313
2 votes
1 answer
247 views

Is there an algebra group (or ring) in which computing the inverse element is hard without some trapdoor information?

Specifically, I want an algebra group $G$ (or ring $R$) features: Given elements $g,h\in G$ (or $R$ ), computing $g\cdot h \in G$ (or $R$ ) is easy. Given an element $g \in G$ (or $R$ ), finding the ...
ming alex's user avatar
  • 368
0 votes
0 answers
369 views

How to create RSASSA-PSS keys using openssl?

I am trying to understand the RSASSA-PSS and process of generating keys with rsassaPss. I am using below ...
Preeti 's user avatar
  • 109
0 votes
0 answers
46 views

How to find modulus and decrypt a message with a CPA on textbook RSA. The encryption oracle only allows two queries

The encryption oracle only allows you to encrypt a custom message $m$ or the secret message $m_s$. In both cases it asks you to choose a public exponent $e>16$. Of course, $n$, is not available. If ...
crypt potato's user avatar
0 votes
0 answers
128 views

Decrypt RSA knowing N, invp, and invq

im having a problem while solving a RSA problem, so i have python script to create a RSA key and cipher, from that i have n, invp, and invq. so my question is possible to decrypt the message only with ...
LM.'s user avatar
  • 1

1
2 3 4 5
56