4
votes
Accepted
Is this new bound for Wiener Attack well accepted?
Is this $\frac 1{\sqrt[4]{18}}N^\frac1 4$ bound well accepted in the cryptanalysis research community?
I see no reason why there would be a doubt. However, the exact bound for Wiener's attack is not ...
- 138k
4
votes
Accepted
Is there an algebra group (or ring) in which computing the inverse element is hard without some trapdoor information?
Trapdoor groups with infeasible inversion have been considered in several papers since the Master's thesis of Hohenberger. They were considered a hypothetical assumption for a long time, but two ...
- 2,115
3
votes
RSA/ ECC keygen HW vs SW
Regardless of the physical protection provided by an HSM or TPM or any hardware cryptographic key storage system, are keys generated in hardware “higher quality” than those generated in software?
...
- 91.8k
3
votes
What happens if we know that for an RSA key pair, the equation $d^e \equiv c \pmod{n}$ holds?
Reformulating: it's asked if disclosing the integer $c=d^e\bmod n$ compromises the security of an otherwise secure RSA public key $(n,e)$ with private exponent $d$. I'll assume $0<d<n$, as ...
- 138k
2
votes
Are Safe and Sophie Germain primes evenly distributed?
Recall that $p$ is a safe prime and $q$ is a Sophie Germain prime when $p=2q+1$ and both $p$ and $q$ are prime. Safe and Sophie Germain primes are sometime useful in cryptography, e.g. in variations ...
- 138k
2
votes
Are Safe and Sophie Germain primes evenly distributed?
So, as far as I can surmise, the existence of infinitely many Sophie Germain primes is still open. There is a preprint on vixra, see here [vixra is a kind of a free for all arxiv server] but it has ...
- 21.2k
2
votes
"crandall" - unsolved CTF challenge - ASIS-quals-2023
That sounds like a fun challenge. Let us look at what this code snippet is doing.
While it hasn't found a prime number p, it will go from $i = 512$ to $i = 256$ and ...
- 7,629
2
votes
What happens if we know that for an RSA key pair, the equation $d^e \equiv c \pmod{n}$ holds?
As a complement to fgrieu's answer, here is an idea of the sort of issues that can occur.
Let's say that $d$ is taken as the inverse of $e$ mod $\varphi(n)$ (it would work pretty much the same with $\...
- 2,115
1
vote
Possible to encrypt message without knowing recipient public key?
What about:
Bob publishes a public key for some secure signature system. Alice trusts it, or will get a way to trust it.
Bob draws a random secret 256-bit key $k$.
Bob symmetrically encrypts the ...
- 138k
1
vote
Prove that if $e.d \equiv 1 \text{ mod } pq$ then it's impossible to have $e.d \equiv 1 \text{ mod } (p-1)(q-1)$
Now I want to prove that for the same pair $(e,d)$ it no longer holds that:
That you are running into difficulties proving it may be due to the fact that it is, as you have laid out, not true.
...
- 145k
1
vote
Is gcd(e,p−1)=1=gcd(e,q−1) similar to gcd(e,phi(n))=1?
If $n=p\,q$, and $p$ and $q$ are prime, and $p\ne q$, then $\varphi(p\cdot q) = (p-1)(q-1)$, from which it follows that for any integer $e$, the propositions $\gcd(e,p-1)=1=\gcd(e,q-1)$ and $\gcd(e,\...
- 138k
1
vote
How much can we compress RSA public keys with two equal size factors?
Marc Joye's method to achieve $2n/3$ prescribed bits is essentially a streamlined version of the following. Bernstein attributes this method to Coppersmith (2003), but it's not clear whether ...
- 12.4k
Only top scored, non community-wiki answers of a minimum length are eligible