Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am planning to develop (make some minor changes) to asymmetric encryption (i.e. RSA). Any suggestions please?

share|improve this question

closed as unclear what you're asking by Lucas Kauffman, Adnan, dr jimbob, Xander, TildalWave Jul 3 '13 at 18:58

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

Never roll you own Crypto. Don't be a Dave! !enter image description here –  Lucas Kauffman Jul 3 '13 at 18:15
The fact that you're asking for suggestions means that you shouldn't do it. –  Simon Jul 3 '13 at 18:21
With all three of your questions in mind, I have to ask - Are you organizing a particularly bad CTF competition? Because that's pretty much the only good use for bad crypto that I can think of. All other uses of bad crypto will only end up in you being the laughing stock. –  TildalWave Jul 3 '13 at 19:30
TildalWave, If you have a technical answer just write down, but I do not think that you have any one...... –  user27889 Jul 4 '13 at 6:37
What is your goal in changing RSA? Change for change's sake is dumb. Change with a specific goal can be a necessary evil, but one has to be really careful. But for us to help you with that, you need to describe your goal. I'm developing an RSA signature variant, but only because I couldn't find an existing scheme which does what I want. –  CodesInChaos Jul 4 '13 at 6:38

1 Answer 1

Well, one suggestion: don't do it. Or, at least, do it for fun, not for actually protecting anything.

It is exceedingly difficult to design a secure cryptographic algorithm. After decades of research, professional cryptographers have found only one method, which is "a lot of scrutiny": an algorithm will be deemed "secure" only after it has been inspected by dozens of other cryptographers for many years, and none of them found anything bad to say about the algorithm. Every detail counts in such inspection, down to the last bit.

Therefore, regardless of what are the changes you envision and how "minor" they look to you, you will not be able to know if the result is secure or not (and, incidentally, the overwhelming majority of "modified algorithms" are not secure).

Even implementing an algorithm, without deviating from the published standards, is difficult, because implementations will most often leak information about the secret values they process (see timing attacks). A basic RSA implementation is little more than some code which handles big integers (and there are good libraries for that), but protection against side-channel leakages is a full-blown active research area, which cannot be summarized in a single Security.SE answer.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.