New answers tagged

0

For n-bit RSA, you need to find two primes whose product is an n-bit number, that is around n/2 bits each. Actually one a bit smaller and one a bit larger, because you don’t want the primes too close together. About one in ln M numbers around M is prime; that’s the natural logarithm. ln (2) is close to 0.7. If M = 2^(n/2), then ln M ≈ 0.35n. You are checking ...


-1

No, you're wrong, because I know roughly every ln p integers has a prime. is a rough estimate, which is actually wrong. The estimation of the prime counting function $\Pi(p)=p /ln(p)$ estimates the total primes between 0 and $p$. So for a number with x bits, you need to look at $\Pi(2^{x}) - \Pi(2^{x-1})$ and compare it to the total number of candidates, ...


0

Little bit late. sEUF-CMA is stronger, because an adversary has more freedom. It can try to find a new hash to messages it already has queried before. If an adversary has no luck in sEUF-CMA, it has no luck in EUF-CMA either. Here the adversary makes no use of its advantage. sEUF-CMA security implies EUF-CMA security, and if we are talking about an ...


1

RSA is deterministic. This means that if you encrypt the same message twice using the same public key, the two ciphertexts are exactly the same. Since the adversary knows both $N_0$ and $E_{pk}(PIN || N_0)$, the adversary can guess a PIN $PIN_{guess}$ and verify their guess by computing $E_{pk}(PIN_{guess} || N_0)$ and checking if it equals $E_{pk}(PIN || ...


1

Authentication-: I understand that authentication is basically digital signature. You can use a digital signature for authentication, be it entity authentication (e.g. in the TLS protocol) or message authentication (e.g. in the PGP protocol). It is however also possible to use other means, e.g. a MAC if you share a secret key: the digital signature is a ...


3

Adding on to the above, the modulus and public exponent can be extracted from the public.pem. The public exponent e is 10001. It turns out that this is a constructed modulus which is very weak and was not generated using recommended security guidelines. The 2048 bit, 617 decimal digit modulus N=pq can be factored immediately because it is a square. That's ...


2

Is it possible to decode the file using the public.pem file No. or do I have to start looking at private keys? Yes. RSA is an asymmetric encryption algorithm. That means that its keys come in pairs, containing a public key and a private key, and that data encrypted with the public key can only be decrypted with the private key.


5

This is an interesting, but completely open question. The ability to compute discrete logs in specific well-chosen groups entails the ability to factor, but there is no other known formal relations. Discrete logs algorithms over prime order fields and factorization algorithms have often worked hand in hand: the same algorithmic principles led to the best ...


4

The formulas are equivalent. From §3.2: $e \cdot d \equiv 1 \pmod{\lambda(n)}$, i.e. $e \cdot d - 1 \equiv 0 \pmod{\lambda(n)}$, i.e. $\lambda(n)$ divides $e \cdot d - 1$. From §3.1: $\lambda(n) = \mathrm{lcm}(p-1, q-1)$, so $p-1$ divides $\lambda(n)$. Therefore $p-1$ divides $e \cdot d - 1$, i.e. $e \cdot d - 1 \equiv 0 \pmod{p-1}$, i.e. $e \cdot d \equiv 1 ...


2

A cycling attack with encryption exponent $s$ relies on $s$ having small multiplicative order modulo the multiplicative order of the ciphertext. If $c^v\equiv 1\pmod{pq}$ and $s^w\equiv 1\pmod v$ then repeatedly encrypting $c$ for $w$ times gives $$c^{s\times s\times\cdots\times s\times s}\equiv c^{s^w}\pmod{pq}.$$ We know that $s^w=kv+1$ for some $k$ so ...


-1

History: Alan Turing and cracking the Enigma machine. Thus: Is this a genuine concern when designing cryptographic ciphers? Could an evil organization employ one of these people to crack cryptographic keys (for any modern cipher)? Yes, as far as you're able to find your Alan Turing and provide what's needed (or build it from scratch, as was the case of the ...


4

You need some kind of authentication of the source. One solution can be to use pre-shared secret. To exchange the secret you need some reliable channel. Only you know if you have such a channel or not. Another approach can be to use TESLA. A brief explanation see here. Also other approaches can be used.


2

That is a weird patent. The title says "RSA"; however the claims are strictly for elliptic curve operations (and while the description is more general, it is written at such a high level that it's hard at times to see what it's actually trying to say). The ideas in the claims appear to be mostly blinding the ECC projective coordinates; this idea ...


1

In asymmetric crypto, security of schemes typically relies on some underlying problem, which seems hard to solve (root extraction for RSA, discrete log for DH, short lattice vectors for lattice-based crypto, etc.). In symmetric crypto, on the other hand, security is ad hoc and we have to rely on heuristics such as diffusion and confusion (which are though ...


2

The topic is a little dated, but similar concepts are discussed using slightly different language. People have questioned whether the computation of individual bits of discrete logarithms, or RSA decryptions is as hard as the overall problem. This particularly relevant in the design of PKC based random number generators such as Blum-Blum-Shub or Micauli-...


1

RSA labs set up Cryptographic Challenges* All bolds are mine! Various cryptographic challenges — including the RSA Factoring Challenge — served in the early days of commercial cryptography to measure the state of progress in practical cryptanalysis and reward researchers for the new knowledge they have brought to the community. Now that the industry has a ...


Top 50 recent answers are included