Hot answers tagged

6

The problem here is that you have a divisor $p$ of $n$ of the form $$ p_h \cdot 10^{208} + p_m\cdot 10^{108} + p_l\,, $$ where you know $p_h$ and $p_l$, but not $p_m < 10^{100} \lessapprox n^{0.16}$. Clearly, the polynomial $f(x) = x\cdot 10^{108} + p_h \cdot 10^{208} + p_l$ will be $0$ modulo $p$ for the right $x = p_m$, which is known to be small. So ...


5

No, this is not secure. Problem is that Alice, knowing $d_{ID}$ and $e_{ID}$, can compute $f=d_{ID}\cdot e_{ID}-1$ which is a multiple of both $p-1$ and $q-1$; then from $N,f$ can efficiently factor $N$ using the algorithm detailed here; and then can computes $d_{ID}$ for any ${ID}$, and thus decipher the normal way.


4

This will probably be closed as a duplicate, but the IV does not have to be secret. Not sure on best practice, but I see no problems in including the IV in the RSA encryption.


4

As of 2021, is RSA the only practical (i.e. safe, production-ready) option for asymmetric encipherment of symmetric keys at rest? Of course not, there are a number of alternatives. For one, there is the Integrated Encryption Scheme, which can be used with either finite fields (e.g. modulo a 2048 bit prime), or over an elliptic curve. While not nearly as ...


3

If the encryption exponent is less than one over the proportion of missing plaintext, then you can use Coppersmith's method. For example, if you are missing bits 3300-3699 of the plaintext, let $t$ be the known plaintext with zeros in places 3300-3699 of the unknown. Then the plaintext is $t+2^{3300}x$ for some unknown number less than $2^{400}$ and the ...


3

No, it's not. Alice knows her own $eH(ID)$ and she knows the corresponding private key. But knowing those two is enough to calculate the factorization of $N$. A probailitstic algorithm to calculate $p,q$ from $e,d$ was in the original RSA paper, later and Alexander May showed in Computing the RSA Secret Key is Deterministic Polynomial Time Equivalent to ...


3

So after searching, turns out the 2nd version is the one given in the original RSA paper, "A Method for Obtaining Digital Signatures and Public-Key Cryptosystems". I assume the 1st method is simply the standard since. As pointed out by a comment $\lambda(n)$ will always be smaller or equal to $\phi(n)$. In RSA, as pointed by Dave Thompsons, $\...


2

Yes, the attack in the question would work for the low modulo of the example. The term "dictionary" is more appropriate than "rainbow table" (used in the context of making a compact table of precomputed hashes). Actual attacks can't work this way though. In RSA as practiced it's impossible to build a large-enough dictionary, as it would ...


2

It is easy to show that in RSA, when e = 3 there are 4 messages m for which the ciphertext is equal to the plaintext and gcd(m, n) = 1 Well, if $m^3 = m \pmod n$ (and assuming $n$ is a conventional RSA modulus, that is, it is $n = pq$, for $p, q$ distinct odd primes), this is equivalent to both of the below holding simultaneously: $$m^3 = m \pmod p$$ $$m^3 =...


1

The question is, why it holds that $(e^{−1} \bmod n \cdot \phi(n)) \bmod \phi(n)=e%{−1} \bmod \phi(n)$? Actually, we have the more general identity $(A \bmod BC) \bmod C \equiv A \bmod C$, for any integers $A, B, C$. In your specific case, we have $A = e^{-1} \bmod \phi(n)$, $B = n$, and $C = \phi(n)$ This more general identity can be easily be seen from ...


1

note: I am not a cryptographer I want to check if my RSA Blind Signatures Implementation is secure to be used in a production-stage application and I also have some questions which I would be so grateful to be answered. Sorry, but when I hear questions like this, it sounds like: I am not a surgeon, but I want to perform some heart surgery. I've done a lot ...


1

You do not even need a randomized IV if you already have a randomized secret key that changes for every message. So any answer will not be fundamentally wrong, as there are no security requirements for the IV. However, I would suggest your read this answer provided by our friendly bear before you meet a less friendly BEAST. However, I would not include the ...


1

Your approach can only be applied to RSA and only if you are using keys generated according to PKCS#11 version >= 2.40. The PKCS#11 standard defines (section 2.1.3 "RSA private key objects" in the 3.0 base specification): "Effective with version 2.40, tokens MUST also store CKA_PUBLIC_EXPONENT." Therefore, you're able to get the ...


1

The most obvious: performance. I know SPHINCS+ being an example where generating public key from the private key is especially costly, there may be other schemes where this is true, but I'm not aware of any. Also, since it's PKCS#11 hardwares we're talking about, and we've mentioned the hash-based stateless signature SPHINCS+ now, we should also mention that ...


1

Alice - knowing $K_A$ - sends $K_A(B, R_A, t, P)$ to $BB$. $BB$ - knowing $K_A$ - decrypts $K_A(B, R_A, t, P)$, obtaining $(B, R_A, t, P)$. $BB$ - knowing $K_B$ and $K_{BB}$ - sends $K_B(A, R_A, t, P, K_{BB}(A, t, P))$ to Bob. Bob - knowing $K_B$ - decrypts $K_B(A, R_A, t, P, K_{BB}(A, t, P))$, obtaining $(A, R_A, t, P, K_{BB}(A, t, P))$. At this point you ...


1

Generating an RSA key is a complex process with many steps that can be implemented with many small variations. It involves generating two probable primes and verifying that they're suitable. Generating a probable prime means generating a random number in the desired range, checking that it isn't divisible by a small prime, and applying a probabilistic test ...


Only top voted, non community-wiki answers of a minimum length are eligible