Hot answers tagged

5 votes

Would encrypting a message twice with RSA with different keys be more secure that once?

Could someone please explain, mathematically, why I am correct/incorrect? This isn't a mathematical explanation, however I believe it's not a mathematical situation. By performing RSA twice, the ...
user avatar
  • 131k
3 votes

is RSA KTS-OAEP necessary?

Using small public exponents would be off the table for one. Assume a $256$-bit symmetrical key $k$ with $e = 3$ as public exponent. If we naively convert $k$ to an integer, then $k^3$ would be an $\...
user avatar
  • 371
3 votes

is RSA KTS-OAEP necessary?

Since randomly generated symmetric key is not likely to repeat, there is no need to use RSA OAEP and RSA KTS-OAEP? Adding nondetermanism isn't the only reason we need padding for RSA; we also have to ...
user avatar
  • 131k
2 votes
Accepted

is RSA KTS-OAEP necessary?

No, it is not necessary, but: you will get (about) the same RSA ciphertext size with any secure scheme; the computational overhead of OAEP is minimal anyway; using textbook RSA is insecure (see the ...
user avatar
  • 84.5k
1 vote
Accepted

RSA not encrypting properly when e=d?

I believe the problem is linked to the size of the message rather than the choices of $e$ and $d$. When deciphering a message, we don't get the result of the message m but rather m mod N. With $N$ ...
user avatar
1 vote
Accepted

Do RSA powers of two modulus always have MSB set to one and so when DER encoded have 0x00 prefix?

Yes, it is always so, if just because the key size is actually the size of the modulus for RSA. The sizes of the primes that produce the modulus should be selected so that the key size is between $[2^{...
user avatar
  • 84.5k
1 vote

|RSA| Is it normal for $\phi(n)$ to work as RSA modulus?

In general a pair of RSA decryption exponents calculated in this way for a modulus $N$ will also work for any modulus $M$ that satisfies $\lambda(M)|\phi(N)$ where $\lambda$ is the Carmichael function....
user avatar
  • 9,576
1 vote

Additively homomorphic (modified) RSA?

I tried proving that $E(message_{1} + message_{2}) \equiv E(message_{1}) \cdot E(message_{2})$. Does anyone see where I messed up? It is appeared you messed up when you tried to take this paper ...
user avatar
  • 131k
1 vote
Accepted

Proving that RSA CCA is possible

The author forgot a few $\bmod n$ along the way. In particular, equation 9.2 is wrong, and should be $$E(PU,M_1)\times E(PU,M_2)\bmod n=E(PU,(M_1\times M_2\bmod n))$$ Also, what follows "note ...
user avatar
  • 122k

Only top scored, non community-wiki answers of a minimum length are eligible