Hot answers tagged

3

What is the difference between the two? That question feels like the question "what is the difference between a truck and an 8 cylinder engine?" They are different, in the sense that they serve different goals. HTTPS may use RSA (just like a truck may use an 8 cylinder engine), however HTTPS has a lot more to it (just like a truck consists of a lot more ...


3

Remark: $p$ and $q$ are distinct odd primes (if not, we can factor $N$), thus $\phi(N)=(p-1)(q-1)$. Define $p'=(p-1)/2$ and $q'=(q-1)/2$. It holds $\phi(N)=4\,p'\,q'$. What's asked is not always possible. As a counterexample, assume $k=2$ (which is a possible $k$, from above remark), and $p\equiv 3\equiv q\pmod4$ (which covers about 25% of RSA keys). If we ...


3

RSA is based on some mathematical theorems. The first theorem that you need to learn is the Euler's Theorem; if $n$ and $a$ are coprime positive integers, then $$a^{{\varphi (n)}}\equiv 1\bmod n.$$ when $n$ is a prime it is the Little Fermat Theorem. This theorem tell us that in the power we use modulo $\varphi(n)$, i,e, $$a^{x} \equiv a^{x \bmod\varphi(n)...


2

This question was already answered in this not-so-great titled question. ($p$ and $q$ being "safe primes" does not matter in this context, but $q$ shouldn't be (much) longer than $p$, as the methods works for $q<p$, but can be adapted by "guessing" the top bits of $q$ otherwise).


2

The square and multiply algorithm allows you to compute $g^k$ in an arbitrary group using $O(\log k)$ multiplications, instead of the $O(k)$ you would expect. This is done by letting: $$k = \sum_{i = 0}^{\lceil \log_2 k\rceil} 2^i k_i,\quad k_i\in\{0,1\}$$ To be the base-2 decomposition of $k$. Then, we have that: $$g^k = g^{\sum_{i = 0}^{\lceil\log_2 k\...


2

What does the order of $U(N)$ has to do with RSA key generation? The usual notation is $\Bbb Z_N^*$ for the multiplicative group modulo $N$, that the question names $U(N)$, and $\Phi(N)$ or equivalently $\varphi(N)$ for its order (number of elements), as given by Euler's totient function. $\forall x\in\Bbb Z_N^*$, it holds $x^{\Phi(N)}\equiv1\pmod N$. This ...


2

Does anyone know some good way to create such a certificate? As you need to put the private key on the server anyways, you could just copy it of and use that for demonstration purposes. Alternatively you could use software versions from the time when such keylength restrictions were not in place. In particular you might want to take a look at FREAK, in ...


2

node-jose only supports RSA OAEP with SHA-1 and no MGF1 or RSA OAEP with SHA-256 and no MGF1 That's extremely unlikely since OAEP does need to use a Mask Generation Function, and there is only one defined: MGF1. So maybe it doesn't specify it explicitly, but it really must support it to be called OAEP. But I'm wondering about RSA OAEP SHA-1. Nimbus JOSE ...


2

HTTPS stands for HyperText Transfer Protocol, it is just the way that web servers handle requests from web clients such as browsers. It is a bit of a misnomer in the sense that it can handle any kind of data, even binary data. The S stands for secure or SSL. It means that the HTTP connection is established over a connection secured by SSL or, as it is now ...


2

Why we don't use additive groups? Is it a security thing? Yes, it's a security consideration. If we used the additive group $(\Bbb Z_N,+)$ rather than $(\Bbb Z_N^*,*)$ for RSA, public encryption would go $M\mapsto C=e\,M\bmod N$ rather than $M\mapsto C=M^e\bmod N$. Problem is, decryption would be trivial since anyone with the public key $(N,e)$ could ...


2

This would be possible by using textbook RSA, where the ciphertext is deterministic You have the right idea there, that a deterministic scheme is the way to go. However note that every scheme is deterministic if you explicitly fix the randomness used. So suppose you encrypt $k$ for $C$ as $c=\operatorname{Enc}_{\text{pk}_C}(k;r)$ using $C$'s public key and ...


1

No, it's not possible (or so we hope). If you could, you could break RSA. Suppose you had an Oracle that, given $n, e_1, e_2, m^{e_1}, m^{e_2}$ with $\gcd(e_1, e_2) = d$, and which is able to output $m$. We can assume that the Oracle only works for a specific $e_1, e_2$ pair. Then, suppose you were given $c = m^d$, and wanted to recover $m$. Here is ...


1

Your question is not clear. Which additive group would you like to use? RSA is hard because the group ${\mathbb Z}_N^*$ has unknown order (assuming the factorization of $N$ is unknown). Which additive group has that property?


1

Encryption/Decryption and Signing/Verifying satisfies two different aspects of the information security triad. Refer to the CIA triad for more information. Encryption/Decryption ( Confidentiality) Encryption makes sure that the content of a message we send through an unprotected medium, stays unknown, even though it falls into the wrong hands. Thus ...


1

So I was wondering, is there any difference between "Encrypting + Decrypting" and "Signing + Verifying"? I mean, if I hash the message and then encrypt it, wouldn't that be the same as Signing it? First of all RSA or any public key is not preferred for encryption, we prefer a hybrid-cryptosystem where a key is transferred/exchanged with public-key ...


1

The immediately obvious solution would be this simple cut-and-choose protocol: Prover: selects a random value $v$ and sends the value $y = v^\ell$ Verifier: selects and sends a random bit $b$ Prover: if $b=0$, sends the value $t_0=v$. If $b=1$, sends the value $t_1=vu$ Verifier: if $b=0$, then verify that $t_0^\ell = y$. If $b=1$, then verify that $t_1^\...


1

Highly suggested paper: Security of Blind Signatures Revisited by Dominique Schröder et al. Especially have a look at Section 3, where the Unforeability and Blindness security games are defined. In case if you don't want to deep dive into the paper, then I give you hereby a high-level description of the corresponding games. Unforgeability: in the ...


1

It (Blind Signature) is unconditionally blind, because if you take a blind message $m\cdot r^e$ and then sign it, you get $m^d \cdot r$ which distributes like a random element in a subgroup of $Z^{*}_{N}$ so even if you have unlimited computational power you can't extract $m^d$ from looking at $r \cdot m^d$. Even if you factor $r \cdot m^d$ you won't know ...


1

1) Say if some hacker knew $p$, why would it be easy for them to find $q, \phi (n), d$? Since $n = p \cdot q $ this implies $q$ is also known by simple division $p = n/q$. Then $\phi(n) = (p-1)(q-1)$ is known By using $e \cdot d \equiv 1 \bmod \phi(n)$ then $d$ is known. This can be found by the extended Euclidean algorithm. $d$ is a prime larger ...


1

With regard to the structure of RSA key files, and how the public key is related to the private key - you can see that the modulus in the public key file is the product of the two large primes contained in the private key file by doing the following: Generate a private key: openssl genrsa -out private.key 2048 Extract the public key from the private key ...


Only top voted, non community-wiki answers of a minimum length are eligible