0

I have some ciphered text c:

25891321569730591340908100200084238908526220639262493280132434760408339201

And a public key modulus n: 

26968512395163253601932973308752915431751775641665954651069702885890373293

And exponent e:

65537

All of them are in the integer format. I also have the private key in the same format (integer). How can I decrypt the ciphered text then? Do I need to convert to the OpenSSL .pem format? If yes, then how can I do that?

I tried decrypting through OpenSSL, I got this error:

error:0406506C:rsa routines:RSA_EAY_PRIVATE_DECRYPT:data greater than mod len

I have also tried searching on this website and I got this link. When I tried that I got the following error:

0:d=0  hl=2 l=  50 prim: appl [ 27 ]       
Error in encoding
894:error:0D07209B:asn1 encoding routines:ASN1_get_object:too long:

Can anyone help?

Improve this question
4
  • 3
    openssl operates on RSA keys in PKCS#1 format. This uses ASN.1 DER. It's quite complicated. Are you doing homework? Does your cryptosystem use insecure "textbook RSA" or a real system like PKCS#1 v1.5? If it's just textbook RSA, I suggest python. It supports big integers out of the box.
    – Z.T.
    Oct 29, 2016 at 0:28
  • Did you try cryptool? It works
    – hax
    Oct 29, 2016 at 1:46
  • 1
    With what you have you simply need to proceed as given in textbooks to obtain the result of the decryption processing. As mentioned by Z.T., it's very simple to perform the computation in Python.
    – Mok-Kong Shen
    Oct 29, 2016 at 8:17
  • This problem appears to be part of a CTF contest, so I won't publish the solution here. However, the value of n has more than two factors, so be careful when calculating the private exponent d.
    – r3mainer
    May 29, 2017 at 2:31

2 Answers 2

Reset to default
2

Actually you don't really need to convert your keys or use OpenSSL. Open a Python console and decrypt your message:

>>> m = (c ** d) % n

where d is your private exponent.

Improve this answer
0

If you want to follow the suggestions in the comments to your question, I suggest you look at the "cryptography" python library, especially at "cryptography.hazmat.primitives.asymmetric.rsa". It's fairly well documented.

See https://cryptography.io/en/latest/ for documentation.

Note that you're working in hazmat territory, so don't use this for serious cryptography without understanding the pitfalls of using cryptographic primitives in a cryptosystem.

Improve this answer
6
  • 1
    I think OP has textbook RSA, not pkcs#1 v1.5 so they don't need python bindings for openssl pkcs#1, they just need big integers. Python's integers have unbounded size.
    – Z.T.
    Oct 30, 2016 at 19:38
  • 1
    if the ciphertext uses pkcs#1 v1.5 padding, then a real crypto library like openssl or a python wrapper for it is the way to go. But if the ciphertext uses textbook RSA without padding, openssl will fail to decrypt it.
    – Z.T.
    Oct 31, 2016 at 18:19
  • 1
    Looks like you're right - cryptography takes a padding object as a parameter for the decryption routine, but as far as I can see, there's no 'dummy padding' class to instantiate and pass in if you're not using any padding at all.
    – Out of Band
    Oct 31, 2016 at 20:57
  • 1
    not using padding at all is extremely insecure, no reason for openssl to implement such an API.
    – Z.T.
    Oct 31, 2016 at 21:15
  • 1
    @Z.T.: OpenSSL does support unpadded/raw RSA, although for commandline it is not default, and as you say it shouldn't be used. But it doesn't directly support decimal strings; only binary for data, and keys in (several variants of) DER (as you noted) or PEM which can be just base64-of-DER but for privatekey can instead be base64-of-encrypted-DER.
    – dave_thompson_085
    Jan 30, 2017 at 23:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .