Hot answers tagged

6

RSA for key exchange is declining rapidly and is not recommended because it does not provide forward secrecy. Without forward secrecy, if someone breaks into the server and obtains the private key, they will be able to fully retroactively decrypt all recorded traffic encrypted under that key. ECDH does not have that problem because the private and public ...


5

Definition of trapdoor function from Wikipedia; A trapdoor function is a function that is easy to compute in one direction, yet difficult to compute in the opposite direction without special information, called the "trapdoor". The reverse trapdoor function is just the reverse usage of it. Normally, for encryption, we want the encryption easy but the ...


3

Q1: The random selection should be $\sqrt[3]{n}<m<n$ due to cube-root attack? Suppose $n$ is 2048 bits long. Then $\sqrt[3] n < 2^{700}$. If $m$ is uniformly distributed in $\{1, 2, \dots, n - 1, n\}$, what is $\Pr[m < \sqrt[3] n]$? Is this probability large enough that you have to worry about it? Now at the end the document it says; ...


3

You aren't using the same salt. The randomness is introduced with the salt: it is generated randomly. The input to the MGF is calculated from the hash and the salt. Thus, if you sign the same message twice, you get different signatures, because the salt is different each time. For the details, see PKCS#1 (RFC 8017) §9.1.1. There are only two ways to use ...


3

Given a 613-bit integer, it is easy to check that it is composite (and we assume that's been done). It can be hard to factor, but that's feasible with GNFS, including with ready-made tools (see Luke Valenta, Shaanan Cohney, Alex Liao, Joshua Fried, Satya Bodduluri, Nadia Heninger's Factoring as a Service), and that's one sure way to demonstrate how many ...


2

It's a translation of $ed \equiv 1 \pmod{\phi(N)}$, namely that $e$ and $d$ are each other's inverse modulo $\phi(N)$, which says that $ed-1$ must be an integer multiple of $\phi(N)$ (recall that $a \equiv b \pmod{c}$ iff $c$ divides $b-a$ in the integers iff $b-a=lc$ for some integer $l$) and some some $k \in \Bbb Z$ exists with $k\phi(N) = ed-1$ (as an ...


2

Without factoring it, you can only tell if the number of factors is one, or greater than one. What you ask is not possible unless at least one of the prime factors of a composite integer is small enough that the integer can be partially factored. If at least one factor is small, then after revealing that prime, a fast primality test could be used on the ...


2

With Paillier, it's easy; generate a random encryption of 0 ($r^n \bmod n^2$ for random $r$ r.p to $n$), and then homomorphically add it to the encryption (that is, $C2 = C1 \cdot r^n \bmod n^2$), and you're done (and all you need is the public key). I don't believe RSA allows this as a possibility...


2

You're correct, the proof isn't precisely correct, because we don't necessarily have $c^{\phi(n)} = 1$, specifically in the case $c \equiv 0 \pmod p$. Here is a more correct approach; we have $c^1 \equiv c \pmod p$ (trivially), and $c^{p-1} \equiv c \pmod p$ for any $c$, prime $p$ (Fermat's little theorem [1]). By induction, we get $c^{k (p-1) + 1} \equiv ...


2

In what's described, nothing makes B sure that A sent the message. And that can't be obtained without some secret on A's side. A common solution is to have A sign the (e.g. encrypted) message, and B check the signature. A PKI (perhaps, implemented using digital certificates) can help ensure B uses A's genuine public key, which is required for this proof or ...


2

You can't. If the user can run the software, they can extract the key from it. There is research on how to make it difficult to extract the key (white box cryptography), but it's not very successful. You need to think about what do you want to accomplish. Does the user encrypt the files to themselves, so that they can decrypt it later? Then you could derive ...


2

Yes, such a group is useful. In particular, when $N= p\cdot q$ where $p,q$ are both strong primes (i.e. $p=2p'+1,q=2q'+1$ where $p',q'$ are also prime numbers). Discrete logarithm in the prime order cyclic groups (order-$p'$ and order-$q'$) is believed to be hard. Such a group is called a group with hidden order. A few examples of application: Fujisaki ...


2

I believe that the python built-in pow(g, p/2, n) does what you want fairly quickly...


1

I think you will find that $42840 - 7789 = 35051$.


1

I'm not sure how I didn't realize there are only two cases: $gcd(p, c) = 1$, or $c\equiv 0 \bmod (p)$. Given this, here's the proof I came with. For the former, the proof into the question is valid. For the latter, we have: $$c\equiv 0 \bmod (p)$$ $$c^k\equiv 0 \bmod (p)$$ for any $k$. So, using transitivity: $$c^k\equiv c\bmod (p)$$ In this case $k=d\bmod (...


1

TLS_DHE_RSA_WITH_AES_256_CBC_SHA is 256-bit AES encryption SHA-1 message authentication Ephemeral Diffie-Hellman key exchange Signed with an RSA certificate We can find the answer in rfc5246 Key IV Block Cipher Type Material Size Size ------------ ------ -------- ---- ----- NULL Stream 0 0 ...


1

I'll try to answer your questions. First I shall write Coppersmith's Theorem. Theorem. Let $0<\varepsilon<1/d$ and $F(x)$ be a monic polynomial of degree $d$ with at least one root $x_0$ in ${\mathbb{Z}}_N$ and $|x_0|<X =\lceil 0.5N^{1/d-\varepsilon}\rceil.$ Then, we can find $x_0$ in time $poly(d,1/\varepsilon,\ln{N}).$ First, notice that in ...


1

The function, in this case, is collision-resistant but despite this, is it still possible to break the EUF-CMA of RSA-FDH? Yes, because the requirement for security is the hash function acting like a random oracle and not it being collision-resistant. To illustrate this, consider the "hash function" $H(x)=x$ which is clearly collision resistant. Yet, RSA-...


1

Yes, nowadays RSA is not considered the de facto algorithm for all public key cryptography needs we have nowadays. BUT, it is still omnipresent and this is not likely to change soon. For instance, TLS 1.3 has dropped the RSA key exchange because of its lack of forward secrecy. So you might think RSA is loosing some traction, however this doesn't mean ...


1

You can use openssl asn1parse to examine any ASN.1 structure. In your case $ openssl asn1parse -i -dump -in cse-18031 0:d=0 hl=3 l= 159 cons: SEQUENCE 3:d=1 hl=2 l= 13 cons: SEQUENCE 5:d=2 hl=2 l= 9 prim: OBJECT :rsaEncryption 16:d=2 hl=2 l= 0 prim: NULL 18:d=1 hl=3 l= 141 prim: BIT STRING 0000 - 00 30 81 89 02 81 81 00-aa ...


Only top voted, non community-wiki answers of a minimum length are eligible