Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [rsa]

RSA is a common public key algorithm, which can be used for encryption and signature. It is a core component of most the security protocols used on the Internet, including the SSL/TLS protocol suite.

9
votes
3answers
2k views

Why does BitLocker not use RSA?

If I do not understand wrong from this post and Wikipedia page of the BitLocker and TPM, by default, BitLocker uses symmetric cryptography like AES. However, TPM is capable of performing RSA ...
0
votes
1answer
46 views

Public key encryption confusion

I'm learning Linux, and currently SSH. But there are details that I don't really understand. I've seen and understood how Diffie-Hellman key exchanges work from a mathematical point of view, but what ...
0
votes
1answer
41 views

Effectiveness of Euler's totient function and Carmichael's totient function in generating the public key in RSA encryption [on hold]

I'm a high school student taking IB and for my EE on Maths, I'm comparing the effectiveness of Euler's totient function and Carmichael's totient function in generating the public key in RSA encryption....
0
votes
1answer
24 views

Server to Server Communication RSA or x509 Certificate

I want to build Server (My) to Server (Other Client parties) web service and I want to add security layer for client verification. Do I need to force clients to create x509 Certificates or RSA key ...
2
votes
0answers
87 views

Attacking a update mechanism using MD5 and RSA

I am currently working on a software challenge where you have to unlock several functions of a piece of software. The software is written in Java. One of them is the update mechanism of the firmware. ...
0
votes
0answers
37 views

Why boxcryptor use hybrid cryptosystem to encrypt files

I do not understand why they need asymmetric key encryption, if the client does not use the public key. As far as I understand it, the user password is used to decrypt the private key and no public ...
0
votes
0answers
5 views

blind signature [migrated]

Reading this paper, I have some questions about blind signatures What is the meaning for unlinkability of blind signatures? I searched wiki, but still cannot understand exactly. In blind signatures (...
0
votes
1answer
38 views

Asymmetric Encryption + Signature workflow

Let´s say that Alice wants to send an encrypted message that only Bob can read, plus confirm that Alice is the person that wrote that message. What is the procedure that will take place? When I see ...
0
votes
0answers
44 views

OHS 11g ECDHE_RSA

I'm pretty new with SSL, but despite this I have a task for that. I'm running Oracle Http Server v 11.1.1.9 and I would like to use the ECDHE_RSA cipherSuites to deal with https connections. In my ...
0
votes
1answer
122 views

RSA 4096 vs. ECC Curve 25519

I want to use GPG to encrypt files before storing them as backup in the cloud. I don't care about interoperability or performance/resource consumption during encryption/decription. I only care about ...
1
vote
0answers
67 views

Is this Key Exchange secure?

There is a key exchange process which I am having a look at. I am aware of key exchange algorithms such as Diffie-Hellman and the like, however as there is a method to provide an initial key out-of-...
1
vote
3answers
142 views

Is it safe if SSH and HTTPS server share the same RSA/DSA keys?

I'm configuring an ssh server for an embedded device. This device already has an x.509 certificate and a pair of public key and private keys stored in it that is used for its HTTPS server. Is it safe ...
3
votes
1answer
77 views

Individual public keys for embedded devices?

I have a hardware device, which collects data. It should then encrypt the data, and send it to a server, which should decrypt the data. The device is an embedded system which can be programmed only ...
1
vote
0answers
71 views

Is GPG's AES encryption that much stronger than its RSA headers? [duplicate]

Correct me if I'm wrong at any point of this questino. I understand that AES is a lot cheaper to compute than RSA (or any form of asymmetric encryption) and that that is why GPG and similar programs (...
1
vote
1answer
103 views

AES, RSA, ECC Key size [closed]

It is generally said that 2048-bit RSA keys are roughly equivalent to 112-bit symmetric keys and 2048-bit RSA keys are "sufficient for commercial use until around the year 2030" (https://security....
1
vote
1answer
45 views

SSL/TLS and PKCS#1-1.5 Encoding - Why?

I read about SSL (version 3.0) and that the PreMasterSecret (pms) is encoded with PKCS#1-1.5 before the client encrypts it with the given public RSA key and sends the encryption to the server. So the ...
1
vote
0answers
58 views

HTTP body E2E encryption protocol

I have 2 servers that communicate each other in HTTP and they are both behind an API gateway. Between the servers and their API gateways the communication is in HTTPS with mutual authentication using ...
3
votes
1answer
95 views

Sending Private Keys, does it make sense?

There's some logic that I'm not following whenever my organization sets up VMs for SSH access. Perhaps someone can help me understand. Our process is currently as follows Generate Keypair on Linux ...
0
votes
2answers
175 views

How to generate the most secure private key? [closed]

I need to generate the most secure private key. Usually I use a command: openssl genrsa -des3 -out mykey.key 2048 Is triple DES secure enough? Is 2048 large enough? Are there any other ways to ...
0
votes
1answer
47 views

More clarity on Certificate, public key, hash

I'm new to this certificate and public keys. So I've a certificate. I exported as .pem. I opened it in textEdit and it looks like the below. I've used below command to see what this certificate ...
0
votes
0answers
42 views

Can I use OpenSSL to generate a key from asn1 configuration file without specifying the modular multiplicative inverse q^-1 (mod p)

I'm trying to create this gimmicky public-private RSA key pair where p and q are the same number. I would want to use the asn1 parser in OpenSSL, but I'm required to specify the coeff parameter, the ...
0
votes
2answers
88 views

RSA generating private and public keys

I'm trying to implement RSA encryption in PHP. I'm stuck at generating the public and private keys. I have P = 61, Q = 53, MOD = P * Q = 3233, N = (Q - 1) * (P - 1) = 3120. How do I chose the value ...
1
vote
1answer
64 views

Does this attack on RSA keys reveals a major flaw, or this is no big deal with good entropy?

William Kuszmaul published a study of an attack for RSA public keys on his blog https://algorithmsoup.wordpress.com/2019/01/15/breaking-an-unbreakable-code-part-1-the-hack/ The basic idea is, when ...
3
votes
0answers
42 views

Import GnuPG Subkey to other Primary Key

Let's say we have two gpg primary keys "Ident-A" and "Ident-B". There is also a subkey "Sub1" used for encryption by "Ident-A". It is possible to add a subkey "Sub2" to "Ident-B" using the private key ...
1
vote
1answer
70 views

Does the key size have an effect of the size of the public key and signature

If I have a 2048-bit RSA and a 4096-bit RSA key is my signature and public key smaller when I use a 2048-bit key vs a 4096-bit one ? (In bytes)
0
votes
2answers
53 views

RSA signature security with short keys

RSA keys with the size of 1024 aren’t considered to be safe anymore. Does this also apply if you use this key for signing only? Can a signature be faked easily with a short key length?
2
votes
1answer
56 views

ECDH and static key encryption

It's been a while and I'm still trying to figure out if my understanding of ECC crypto is correct. Basically from what I understood a purely asymmetric encryption is never used. Usually the ...
1
vote
2answers
131 views

Can I use RSA to encrypt an AES256 key that I put at the beginning of my AES256 encrypted file?

I have a master server generating large files for other (known) servers to download. Those files: Are quite big. From 20MB to 5GB. Are written once by the server and then it forgets about them. ...
3
votes
1answer
61 views

To what extent are countermeasures against side-channel attacks effective/ used regularly by everyone?

I'm doing an Extended Essay for IB right now and I'm doing it on how secure RSA is. As side-channel attacks are one category of attack, I was wondering (as I am struggling with the conclusion) while ...
2
votes
1answer
90 views

How does algorithms ensure public/private keys uniqueness? - RSA

I'm new to security and crpyto, I know that Public/Private keys are generated in a different way depending on the used algorithm, But let's take RSA as an instance (Using prime numbers), Does the ...
1
vote
0answers
177 views

Where To Store Public and Private Key files?

I'm creating a Java web-application using a WAR file to be deployed on a server. I will only be using one single web server and hosting. In my project, I'm generating two files: Public Key file and ...
2
votes
3answers
145 views

Does every recipient receive a different version of “encrypted” email using PGP?

If I understood it correctly, PGP encrypts email by using receiver's public key. In a multiple-receiver scenario, does that mean each receiver will get a different version of "encrypted" email but the ...
1
vote
1answer
51 views

Public Key Crypto - sign Bob's name into Alice's message or encrypt Alice's name

I was reading Defective Sign & Encrypt in S/MIME,  PKCS#7, MOSS, PEM, PGP, and XML and in section 5.1  Naming Repairs By signing Bob's name into her message, Alice explicitly identifies him ...
1
vote
2answers
101 views

Why digital signatures needs different algorithm

Why digital signatures uses algorithms such as DSA, ECDSA or RSA-PSS, and not just the RSA algorithm to encrypt the message hash with the private key? Is the choice more security or performance ...
3
votes
0answers
45 views

Naked RSA decryption

I'm working with some legacy code that uses naked RSA encryption with variable length packets. I've only found example code on how to handle this when the length of the packet is the correct length ...
0
votes
2answers
85 views

Is it necessary to encrypt messages client side if using HTTPS?

I am creating a messaging service for an app I'm developing and right now the data flow is as follows: Send: message sent to server => message encrypted based on user's public key and signed using ...
0
votes
1answer
343 views

SHA 1 with RSA for ssl certificate

Hi using SHA 1 with RSA encryption for ssl certificate is secure? As i know, sha 1 is not secure, but if we use RSA with sha1, still it will be an issue? Please suggest if any security issues exist.
0
votes
1answer
126 views

Does hashing a file consider its digital signature as well?

I have a signed (using Windows signtool) executable which is hashed by SHA1 algorithm and encrypted using RSA. Now I like to verify the executable to avoid security vulnerabilities. For that I have an ...
1
vote
1answer
316 views

Web Crypto API maturity for JavaScript RSA encryption?

We have been using a JavaScript crypto API to do RSA encryption in the browser. I know all the criticisms on encryption in JavaScript but we have evaluated pros and cons of the solution and the risks ...
1
vote
3answers
239 views

Recommended asymmetric algorithms for JWT?

I'm implementing JWT authentication for a new web service and am unsure which asymmetric algorithm to choose. I've searched around and haven't found any consensus or clear recommendations. According ...
0
votes
1answer
50 views

RSA uses substitution and shuffling?

I've been doing some searches for RSA and it appears that it uses shuffling but not substitution. Is this true? Simple explanation of the algorithm: https://www.geeksforgeeks.org/rsa-algorithm-...
-1
votes
1answer
70 views

Deducing private key in RSA encryption from public key, cyphertext and plain text

Assuming someone is doing MITM attack. He knows the cyphertext, the public key and the plaintext message, can he deduce the private key from these 3 elements?
1
vote
2answers
221 views

How to handle end to end encryption [closed]

I am working on an app where the goal is to upload user data, store it, do some processing on that data and present it to user when asked. We want to follow end to end encryption model where the ...
1
vote
1answer
143 views

Storing RSA private/public key pairs in a file, on linux

Would it be wise to: Generate a lot of priv./pub. key pairs, and store them in a file on the server machine(Linux). (Let's say in a companies server room) Then encrypt the file with AES, and store ...
2
votes
0answers
132 views

mbedtls mutual authentication [closed]

I have a server CA cert, device cert and the device private key. I am using mbedtls and want to be able to create a mutual authentication connection between the device and the server. I also have to ...
1
vote
1answer
129 views

How to encrypt and sign a message with RSA?

I have been doing research on how RSA encryption works (mostly from a math's point of view) and I have come to understand this: By encrypting with the public key of bob, only bob can decrypt it with ...
0
votes
2answers
47 views

Does the symmetric key exchange through asymmetric encryption have to be done asymmetrically?

To communicate over a public channel, it seems often that 2 parties first use some asymmetric-encryption way to exchange a symmetric key. And then use the symmetric key for subsequent communication. ...
1
vote
3answers
87 views

How to enforce confidentiality while keeping the authenticity?

Below is an illustration of the digital signing process. According to Wikipedia: A digital signature is an authentication mechanism that enables the creator of the message to attach a code that ...
1
vote
0answers
59 views

Advantage Of ECDH-RSA over RSA Ciphersuites In TLS

If ECDH-RSA is used for key exchange, this is what happens: The server has its public ECDH parameter embedded within its certificate. The client generates its public ECDH parameter, extracts the ...
4
votes
1answer
257 views

when should i use HMAC-based JWT?

I read a number of blog posts and found that it is tough to keep the secret-key a secret and if using a symmetric algorithm for JWT creation, the generator has the power to create as well as validate ...