Skip to main content

Questions tagged [rsa]

RSA is a common public key algorithm, which can be used for encryption and signature. It is a core component of most the security protocols used on the Internet, including the SSL/TLS protocol suite.

Filter by
Sorted by
Tagged with
1 vote
0 answers
22 views

Are ECC CSR always different and if yes, why? [closed]

I've noted that SHA256 of CSRs for RSA keys, generated as openssl req -new -config leaf.conf -key rsa.key rsa.csr are always the same, given the same key and configuration. In the same time, every ...
simon's user avatar
  • 181
-1 votes
1 answer
42 views

Fido2/Webauthn Passkeys: rsa2048, rsa4096, or Ed25519?

Does anyone know what kind of keys are being generated when you make a Fido2/Webauthn passkey? rsa2048, rsa4096, Ed25519, or something else? Just worried if its rsa2048 it might soon be crackable, at ...
Mohamed Hafez's user avatar
0 votes
0 answers
43 views

How to allow users to securely use their private key to decrypt data in the browser [duplicate]

I'm working on an application where encrypted data can be stored on the server. Users can do this by obtaining public keys from the server, and use them to encrypt data locally before sending it to ...
Bart's user avatar
  • 1
1 vote
1 answer
145 views

Hide password from server

I’m a beginner in cryptography and for my first project I use the client’s password to encrypt some data. More specifically, I use the password as passphrase in RSA private key generation). However, I ...
yolooow's user avatar
  • 25
0 votes
1 answer
117 views

Why Ransomware generate keypair in victim?

I read this answer Ransomware encryption keys and understood how wannacry works. But I still have a question: as I understand, the hacker will put the hacker's RSA public key in the malware, the ...
Thanh's user avatar
  • 1
0 votes
1 answer
101 views

Secure Transmission of Secret Keys Between Mobile App and API Server

I need to establish a secure method for transmitting shared secret keys between a mobile app and an API server to ensure the integrity of the data. When initially exchanging shared secret keys, I'am ...
Mason's user avatar
  • 3
0 votes
1 answer
125 views

Why does this application include a private RSA key?

I downloaded an application, based on electron. I then decompiled the app.asar file. And I found two strange files: "server.cert" and "server.key". The private RSA key corresponds ...
user avatar
1 vote
2 answers
100 views

Web Browser and server using ECDHE_RSA cypher suite, then what is the use of X.509 certificate public key for?

User Crover has given a very great explanation for this question: RSA or ECDHE for x.509 certificates-what does each do? I have one question to Crover and/or any other member. What I understand from ...
Imran S's user avatar
  • 11
0 votes
0 answers
110 views

RSA vs Shor's Algorithm/Fast Factoring — Server Credentials & MITM

I've watched a lot of videos on Shor's Algorithm and Quantum Computers. Most of these videos say these two things undermine RSA via fast-factoring, but they never really explain how fast-factoring is ...
Sam Z's user avatar
  • 1
1 vote
1 answer
185 views

Is it possible to combine RSA and XOR?

For my project in uni I need to combine asymmetric and symmetric cryptosystems. I wanted to do thing with AES and RSA but it's a little difficult for me and I want something easier. So I thought that ...
karalesus's user avatar
0 votes
1 answer
283 views

Why in "openssl pkeyutl -verify" is needed both public and private keys? Why isn't public key enough?

I created a signature with: openssl pkeyutl -sign -inkey rsa.key.bob -in plain -out plain.sig.bob and to verify, Alice just needs to use Bob public key to check the authenticity of the message. So ...
Allexj's user avatar
  • 137
3 votes
2 answers
568 views

Decrypting network traffic and finding HTTPS private key

I've been battling with one school task for couple days and can't seem to find any idea how to solve it. The task is pretty simple: Log in to the server using SSH. The answer to the task is in ...
Paul's user avatar
  • 95
5 votes
2 answers
7k views

Why do I get the error "dh key too small" when the RSA key is 2048 bits?

When I try to connect to the site https://api-mte.itespp.org with OpenSSL (openssl s_client -connect api-mte.itespp.org:443 -brief), it complains that the DH key is too small. But when I analyze its ...
geckels1's user avatar
  • 153
0 votes
0 answers
92 views

What is the best way to encrypt asymmetric metadata?

As a hobby project I'm thinking about how to write a secure chat where even all metadata are encrypted so that it is impossible to leak any (meta) information by design. My basic idea is right now: ...
rekire's user avatar
  • 133
0 votes
2 answers
118 views

Asymmetric crypto algorithm for encryption with hardware token

Our product stores voucher data in a database. These voucher data can be retrieved with our app to display a voucher that can be used for payments. Obviously, these voucher data are extremely ...
Erik Moldtmann's user avatar
0 votes
2 answers
599 views

Most secure way to pass data from client to server?

I'm writing an authentication system and would like some suggestions on improving its security. Currently, I use RSA to communicate data between the client and the server. Here's the process: The ...
Daniel Rayburn's user avatar
0 votes
1 answer
208 views

Is backing up the seed used to generate an RSA key pair a secure practice?

Assume I wanted to generate an RSA key pair, and create a backup of it. It is possible to back up the randomness source used to generate the keypair instead of the keypair itself and still recover the ...
Jakub's user avatar
  • 135
1 vote
1 answer
155 views

Encrypted user data and storing hashed RSA keys on the server for backup reasons

Imagine a mobile app that connects to an API server. Disclaimer I'm not sure if RSA is the right technique for this, please feel free to recommend alternatives. The goal The backend/database super ...
Laisender's user avatar
  • 111
4 votes
2 answers
242 views

How can I ensure that a CSR doesn't rely on a revoked private key

CRL lists the revoked certificates of a CA by sending back to the user the Serial Number of each certificate, nothing related to the public key. I don't know how it works for OCSP. Is there a ...
Antonin M.'s user avatar
1 vote
0 answers
231 views

Microsoft Software Key Storage Provider for ECDH (Key Usage: keyAgreement) and for RSA encryption (Key Usage: keyEncipherment)

In the Windows Certificate Store, during a request creation, there are options given for the private key to be ECDH (Key Usage: keyAgreement) and for RSA for encryption only (Key Usage: ...
ARGYROU MINAS's user avatar
-1 votes
1 answer
110 views

Digital Signatures [closed]

In RSA signatures, Alice signs the message using her private key, and Bob verifies the message using Alice's public key. If an attacker has the signed encrypted message, then can they also verify the ...
MxML's user avatar
  • 1
0 votes
1 answer
493 views

Can RSA key be used as key for symmetric encryption?

I know RSA is asymmetric (public / private) key. But, is possible to generate only a private key with rsa and using it as symmetric? For example with openssl?
elbarna's user avatar
  • 175
1 vote
1 answer
1k views

Best practice for sharing and storing encrypted data between server and client

I'm working on a system that shares data between a client and server. The end goal of this system is to store server-encrypted data on the client's hard drive, using keys generated by the server. the ...
MatkatMusic's user avatar
2 votes
1 answer
210 views

When signing with server public key, how do I prove server key is trustworthy?

I have a server-side app in a Docker container that communicates with my desktop client app. I am struggling with how to ensure that the response from the server is trustworthy. I am fairly new to ...
MatkatMusic's user avatar
8 votes
3 answers
2k views

What makes chopping RSA payloads into constant size chunks unsafe?

I am encrypting chat messages with RSA thus speed is no issue. It was working fine before I tried transmitting a long message. Now I need to cope with the fact RSA is block, instead of stream, based. ...
Vorac's user avatar
  • 1,907
0 votes
2 answers
395 views

Asymmetric encryption and data sharing

I have a web application created with Flask in python that uses asymmetric encryption using RSA, the private key is generated from the user's password and is only stored in a cookie on the user's ...
user avatar
2 votes
3 answers
294 views

Is it safe to check-in a RSA private key?

As far as I know, it is bad to check-in something like a password in a version control system. However, I saw in a project that a private_key.pem file with -----BEGIN RSA PRIVATE KEY----- ... content ...
fabpico's user avatar
  • 121
1 vote
0 answers
67 views

Question regarding DH/RSA/Public key cryptography [closed]

Courses giving introduction to cryptography often refer to an example where Alice and Bob need to communicate through an evil postman, and dispose each of a lock, its key and a box in which to send ...
greg27's user avatar
  • 19
2 votes
2 answers
2k views

Encrypt with private and decrypt with public keys /Openssl

Hi, Recently, I was studying about openssl. I found that encrypting with a private key is allowed while decrypting with the public one isn't, and throws an error: unable to load Private Key or A ...
AmineLBD's user avatar
0 votes
1 answer
136 views

Authenticate people online with simple public / private key scheme or similar

how can I ensure that person X on website A is the same person who contacts me? Here is my use case. On website A I post message asking username X to contact me. Someone send me an email - how do I ...
Lofter's user avatar
  • 1
1 vote
0 answers
105 views

Message is encrypted with RSA 1024 public key A (from pair A1-B1). What is probability to decrypt with private key from different pair (A2-B2)?

Our program encrypts the message with RSA 1024 public key A (from specific pair A-B). Then the program sends the encrypted message to the server. The server maintains a list of public-private key ...
TomR's user avatar
  • 121
1 vote
1 answer
1k views

How to extract a RSA private key from an ssh-agent core dump

I need to extract an RSA private key from an ssh-agent core dump running on ubuntu 20.04. I believe the ssh version is the latest. I have tried many Linux tools with no luck. I also wrote a python ...
Wesley Jones's user avatar
1 vote
1 answer
965 views

How to encrypt with a private RSA key in Openssl

The RSA_private_encrypt is deprecated in OpenSSL 3.x. It is not clear how to get the same functionality in 3.x without using the deprecated functions. And, before you ask, IEC_62351-9 Section 9.1.3....
tstone's user avatar
  • 11
0 votes
1 answer
209 views

Using two different random numbers instead of RSA Keys

Binance public API supports access to specific operations with RSA key pair. Firstly customer generates an RSA key pair. The customer uses the secret key to hash(SHA256) the query string parameters ...
Ahmet Arslan's user avatar
3 votes
1 answer
261 views

What is the right way to transfer public-private keypairs over intranet?

First asked on StackOverflow and referred to this board, here: I have an embedded system (Netburner 5441x) that encodes public-private RSA keypairs into devices. I have ported OpenSSL into the system ...
Larry Martin's user avatar
2 votes
2 answers
1k views

When renewing a TLS certificate (no change to CSR nor private key), will the modulus remain the same?

Here is the scenario, just wanted confirmation that I am understanding it correctly. I have a TLS certificate that will expire soon; Upon renewal, I paid the CA, and they reissued me with a new public ...
joedotnot's user avatar
  • 337
2 votes
2 answers
3k views

Is there a relationship between the size of RSA key and size of hash function?

I have seen that for RSA2K the hash function SHA-256 has been used. Now my question is if I want to use RSA3K, should I change the size of the hash function for example from SHA-256 to SHA-384? Is ...
TJ1's user avatar
  • 123
2 votes
0 answers
749 views

Sign according RSASSA-PKCS1-v1_5 standard

I'm totally lost with is standard RSASSA-PKCS1-v1_5. I have commands that signs document and checks signature below. openssl dgst -sha256 -sign private-key.pem -out aaa.txt.sha256 aaa.txt openssl dgst ...
vico's user avatar
  • 279
0 votes
1 answer
880 views

Why REST APIs that do not use RSA encryption to secure API keys?

After using many APIs, I noticed that most of them offer 2 keys: API Key and Secret Key. The secret key is used to sign the request body with HASHAGE algorithm, the most used is HMAC SHA256. This ...
jojupiter's user avatar
0 votes
0 answers
4k views

How to decrypt an OpenVPN EasyRSA Encrypted Private Key?

I want to copy my OpenVPN configuration from a client configuration file to my pfSense firewall. pfSense requires me to provide certificate and key. This is how they look like in the .ovpn ...
Aileron79's user avatar
  • 101
2 votes
1 answer
1k views

SSH Handshake on Cisco IOS XE

I've configured the following on my IOS XE device. ! ip ssh rsa keypair-name my-4096rsa-ssh-key ip ssh version 2 ip ssh server algorithm mac hmac-sha2-512 hmac-sha2-256 ip ssh server algorithm ...
TimmayG's user avatar
  • 21
0 votes
0 answers
3k views

How to properly encode in PEM an RSA private key encrypted with another RSA key?

Say I have an RSA private key, if encoded in PEM, it usually looks like: -----BEGIN RSA PRIVATE KEY----- <base64 encoded bits> -----END RSA PRIVATE KEY----- If I encrypt the said key with a ...
zypA13510's user avatar
  • 167
0 votes
1 answer
1k views

Can an encrypted RSA key be committed to git?

I have a pair of RSA keys where the private key is encrypted with a passphrase. Would it be a security risk if the public and private keys are committed to version control without any further ...
Runtime Terror's user avatar
0 votes
1 answer
86 views

Why does PCKS1-v1.5 signing require DER wrapping?

Reading RFC3447, Section 8.2.1, primitive RSASSA-PKCS1-V1_5-SIGN requires an encoding into ASN.1/DER. Why not just sign the raw hash bytes rather then wrapping them as ASN1?
Freeman's user avatar
  • 145
0 votes
0 answers
97 views

Authenticated connection client/server

I am reasoning about the following scenario: A server listening on a port A client (always the same) that sends messages When the server receive a message, it performs an action and then responds to ...
Matteo's user avatar
  • 1
0 votes
1 answer
1k views

GPG4WIN Kleopatra does not require RSA secret key components to decrypt

I was thinking of using gpg4win to encrypt files I'll upload to cloud storage services. I already use 7-zip so if I just wanted to password protect my files I could have easily done it, but I wanted ...
Dominic Jung's user avatar
1 vote
0 answers
28 views

Why is it not a good idea to simply encrypt the plaintext with the receiver’s public key? [duplicate]

What are some of the risks when encrypting "plaintext" with a receiver's public key? I have been Googling for hours, and been reading in the Computer Security Principles and Practice 3rd ...
John Smith's user avatar
4 votes
1 answer
5k views

TLS 1.3 RSA key exchange

I have some confusion between the different public and private keys that are used in a TLS 1.3 connection. When a client makes a request to a server, I've always thought that a server's TLS x509 ...
Joe J's user avatar
  • 143
1 vote
3 answers
1k views

Why are we using RSA although it will be cracked by quantum computers?

Why do we still use RSA 2048 when we know that quantum computers can crack RSA as fast as classical computers can create the key? Providers, governments, APTs, etc. can sniff all the traffic and as ...
NikolaTesla's user avatar
1 vote
2 answers
123 views

Avoid re-encrypting persisted cipher texts when using certificates

An application uses RSA to encrypt small texts before persisting in database, using public key of the end node of the application. Only these end nodes must be able to decrypt thge ciphers and only ...
Bjarne Hest's user avatar

1
2 3 4 5
15