0

I have some ciphered text c:

25891321569730591340908100200084238908526220639262493280132434760408339201 

And a public key modulus n:

26968512395163253601932973308752915431751775641665954651069702885890373293

And exponent e:

65537

All of them are in the integer format. I also have the private key in the same format (integer). How can I decrypt the ciphered text then? Do I need to convert to the OpenSSL .pem format? If yes, then how can I do that?

I tried decrypting through OpenSSL, I got this error:

error:0406506C:rsa routines:RSA_EAY_PRIVATE_DECRYPT:data greater than mod len

I have also tried searching on this website and I got this link. When I tried that I got the following error:

0:d=0  hl=2 l=  50 prim: appl [ 27 ]       
Error in encoding
894:error:0D07209B:asn1 encoding routines:ASN1_get_object:too long:

Can anyone help?

  • 3
    openssl operates on RSA keys in PKCS#1 format. This uses ASN.1 DER. It's quite complicated. Are you doing homework? Does your cryptosystem use insecure "textbook RSA" or a real system like PKCS#1 v1.5? If it's just textbook RSA, I suggest python. It supports big integers out of the box. – Z.T. Oct 29 '16 at 0:28
  • Did you try cryptool? It works – hax Oct 29 '16 at 1:46
  • 1
    With what you have you simply need to proceed as given in textbooks to obtain the result of the decryption processing. As mentioned by Z.T., it's very simple to perform the computation in Python. – Mok-Kong Shen Oct 29 '16 at 8:17
  • This problem appears to be part of a CTF contest, so I won't publish the solution here. However, the value of n has more than two factors, so be careful when calculating the private exponent d. – squeamish ossifrage May 29 '17 at 2:31
2

Actually you don't really need to convert your keys or use OpenSSL. Open a Python console and decrypt your message:

>>> m = (c ** d) % n

where d is your private exponent.

0

If you want to follow the suggestions in the comments to your question, I suggest you look at the "cryptography" python library, especially at "cryptography.hazmat.primitives.asymmetric.rsa". It's fairly well documented.

See https://cryptography.io/en/latest/ for documentation.

Note that you're working in hazmat territory, so don't use this for serious cryptography without understanding the pitfalls of using cryptographic primitives in a cryptosystem.

  • 1
    I think OP has textbook RSA, not pkcs#1 v1.5 so they don't need python bindings for openssl pkcs#1, they just need big integers. Python's integers have unbounded size. – Z.T. Oct 30 '16 at 19:38
  • 1
    if the ciphertext uses pkcs#1 v1.5 padding, then a real crypto library like openssl or a python wrapper for it is the way to go. But if the ciphertext uses textbook RSA without padding, openssl will fail to decrypt it. – Z.T. Oct 31 '16 at 18:19
  • 1
    Looks like you're right - cryptography takes a padding object as a parameter for the decryption routine, but as far as I can see, there's no 'dummy padding' class to instantiate and pass in if you're not using any padding at all. – Pascal Oct 31 '16 at 20:57
  • 1
    not using padding at all is extremely insecure, no reason for openssl to implement such an API. – Z.T. Oct 31 '16 at 21:15
  • 1
    @Z.T.: OpenSSL does support unpadded/raw RSA, although for commandline it is not default, and as you say it shouldn't be used. But it doesn't directly support decimal strings; only binary for data, and keys in (several variants of) DER (as you noted) or PEM which can be just base64-of-DER but for privatekey can instead be base64-of-encrypted-DER. – dave_thompson_085 Jan 30 '17 at 23:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.