Questions tagged [rsa]

RSA is a common public key algorithm, which can be used for encryption and signature. It is a core component of most the security protocols used on the Internet, including the SSL/TLS protocol suite.

Filter by
Sorted by
Tagged with
0
votes
1answer
120 views

How to encrypt a >1MB file with RSA? [duplicate]

I am new to cryptography, so please excuse any "obvious" beginner mistakes. I need to send a file larger than one MB to Bob, but my RSA keys are only 1024 bit large. I believe this means I can't use ...
0
votes
1answer
113 views

How can I distribute highly confidential keys for a symmetric cipher?

Say I want to exchange a key with someone for a symmetric cipher (say AES) without meeting them in person. What would be the most secure way to do this over the Internet? My first instinct would be ...
1
vote
2answers
78 views

Use RSA key to encrypt/decrypt personal document

Suppose I have generated a public/private RSA4096 keypair using GPG. Is it secure to use this keypair to encrypt/decrypt documents solely for personal use, i.e., have an encrypted backup of some very ...
0
votes
1answer
45 views

Is it secure to use a single pair of RSA keys to achieve mutual authentication?

I saw this design recently in an infotainment product. The goal is mutual authentication between two ECUs, E1 and E2. They only care about each other. The basic idea is to keep both keys secret and ...
0
votes
1answer
31 views

How can I add bits of security? (e.g. RSA + ECC)

If we have an RSA layer of encryption over some text with n bits of security, then we use an elliptic curve, say with m bits of security, how can we calculate the total bits of security with RSA(ECC(.....
-1
votes
0answers
72 views

Why is RSA secure if I can solve the equations for it using a math solver? [migrated]

To factorize N = p * q with p < q e (p-2) mod 9 = 0, there are a set of equations. These equations can be put into any popular math solver, in order to gain access to the primes p and q. For ...
1
vote
4answers
103 views

Data too large for key size while trying to sign then encrypt

I'm not very experienced in the security field, but I'm trying to sign then encrypt a large folder in order to deal with software updates in some machines that will be offline. I've thought about ...
0
votes
1answer
68 views

How to obtain body from RSA signed document without verifying signature?

According to my understanding of computational cryptology, the body of a signed document can be retrieved disregarding whether or not the signature is authentic. However, I cannot apply this ...
0
votes
1answer
53 views

How to implement server/client software where only user can access his files via key-pair

I want to implement a server side application with REST API - clients are browser and mobile app. User will have a login (email, password) and will store his files on the server. These files must be ...
2
votes
1answer
112 views

Should I stop using DSA key algorithm self-signed certificates in production in favor of RSA Certificates?

We use a self-signed certificate with DSA key algorithm (and RSA signature algorithm) for securing a Kafka cluster in production. The access to the Kafka servers is already limited (by firewall) by ...
1
vote
1answer
78 views

RSA key exchange is obsolete. Enable an ECDHE-based cipher suite

If what this says is what I think, does that mean the connection could be compromised and or vulnerable to MitM &/or other attacks? Cert shows to be good, but there is this "RSA key exchange is ...
2
votes
1answer
62 views

RSA SecureID - is the serial of the key public?

If I am having an RSA SecureID hardware key, I can see serials/numbers at the back of the SecureID (so not the every-minute changing token)? Is that public information? Or should the serials on the ...
2
votes
1answer
119 views

Is there a name for this (unconventional?) use of RSA for authentication?

I am writing an article about a late-1980s system that uses the RSA algorithm for the purpose of authentication. However, rather than the usual approach of encrypting a hash of the message using a ...
1
vote
1answer
41 views

Mix and match RSA and ECDSA in TLS

Suppose TLS client and server want to communicate, authenticating both parties. They each have sufficiently trusted certificates, but one corresponds to an ECDSA private key and the other corresponds ...
2
votes
1answer
67 views

RSA key size in TLS ciphersuite with RSA key exchange

I'm using the TLS cipher suite TLS_RSA_WITH_AES_256_CBC_SHA56. The Public Key of the Server's Certificate is RSA (2048 Bits) I understand that the RSA algorithm is used here for for key exchange, as ...
1
vote
2answers
86 views

ECDHE_RSA_WITH_AES_128_GCM_SHA256 - How to determine ECDHE Key Length?

Server: SSL Certificate, 2048-bit RSA Public Key, Signature Algorithm is sha256RSA What am I missing here? ! I've scoured the RFC's, and I have yet to find anything on how to determine the ECDHE key ...
0
votes
0answers
85 views

How is a cryptographic key used as a password when using WiFi? [duplicate]

I have recently come from a post and the accepted answer described the password as a cryptographic key. I have an understanding of RSA, AES and uses of it such as digital signatures however I fail to ...
0
votes
0answers
45 views

Can I know the RSA encryption algorithm using the key-pair and encrypted data? [duplicate]

I generated ssl certificate and its key shared it to a third party. They claim that they use my ssl to encrypt data using RSA PKCS1. But I am not able to decrypt it using RSA:ENCRYPTION_PKCS1, I ...
1
vote
1answer
49 views

Is a pure-JS raw RSA implementation secure for transferring information? [closed]

Assuming I have the RSA forge (javascript) library, does the pure-RSA implementation work for information transferring? I know that the forge library has the keysystem and everything, but I want to ...
2
votes
3answers
659 views

Recommended asymmetric algorithms for JWT?

I'm implementing JWT authentication for a new web service and am unsure which asymmetric algorithm to choose. I've searched around and haven't found any consensus or clear recommendations. According ...
0
votes
2answers
756 views

RSA or ECDHE for key establishment?

Recently, i have been looking at PKI and certificates, and TLS 1.2 as part of my study of cryptography. I have the understanding that the public key included in the certificate of a website is the key ...
34
votes
1answer
5k views

How does OpenSSL generate a big prime number so fast?

In order to generate a 2048 bit RSA key pair, you need to generate two big prime numbers with 1024 bits length. As far as I know, OpenSSL chooses a random 1024 bit number and starts looking for a ...
0
votes
1answer
54 views

Are all web servers for a domain wildcard certificate supposed to have the same private key?

If I have three web servers that all have the same CSR based on a domain, *.domain.com, does that mean all the servers have the same private key? I know it's a short question, but I am not sure of ...
0
votes
1answer
52 views

Is it secure to store an rsa private key with aes encrypted in your database?

I want to use multiple clients but I don't want different public key for that specific user. So I have to share the private key between all clients that I only have to use one public key. So I thought ...
7
votes
2answers
2k views

How does the WhatsApp chat history recovery work together with their encryption mechanism?

As WhatsApp states: every time a user installs or updates the app, a new key pair would be generated on the user's device. So I assume that the chat history on iCloud which was encrypted by the old ...
0
votes
0answers
51 views

How do you generate a RSA private key that is BER encoded with OpenSSL?

According to the Linux Kernel's Asymmetric Cipher API found at the following URL: https://www.kernel.org/doc/html/latest/crypto/api-akcipher.html#asymmetric-cipher-api, you must pass a BER encoded ...
2
votes
1answer
104 views

is it safe to AES encrypt the RSA private key and storing it in the database

i'm building an app that really needs encryption of this type , my question is it safe to store the aes encrypted RSA key in the database ? here is how i encrypt the key : i generate a random 256 ...
0
votes
1answer
117 views

Is asymmetric encryption is safe on the Internet? Can't a hacker just pose as a valid user?

When I read the RSA asymmetric encryption: In the environment: Rules are: blue boy, red girl, and black men. blue boy and red girl all have their own public key (blue) and private key (red). In ...
2
votes
1answer
98 views

Is there a password based challenge response authentication scheme with public key cryptography?

I was thinking about an authentication where the user only has to know a password but no salt, everything else the client retrieves from the server yet a user's password can't be retrieved from the ...
0
votes
0answers
42 views

Offline code signature verification scheme

Assume that I want to sign digitally updates for an offline appliance (lets say a limited linux VM). To begin with, such mechanism is not in place and the very limited OS doesn't have any CA ...
1
vote
2answers
4k views

RSA for authentication?

Is it possible to use RSA public and private keys to authenticate two computers (or to make sure they're both the right computers)? If so, how? Thanks!
0
votes
0answers
53 views

percentage of X.509 certs using rsaEncryption as publicKey algorithm

Quoting 2017_TLS_Telemetry_Report.pdf: Not surprisingly, 2048-bit keys now protect 90% of the world’s TLS hosts. The use of 4096-bit keys have quadrupled, as a share of hosts, but we expect it to ...
1
vote
0answers
117 views

how to generate RSAES-OAEP keys?

RFC4055 describes RSAES-OAEP keys and RSASSA-PSS keys. OpenSSL's genpkey utility supports let's you generate RSASSA-PSS keys (you have to set the aglorithm parameter to RSA-PSS) but if it supports ...
5
votes
2answers
368 views

Passwordless website authentication scheme

Edit: This scheme has since been standardised as WebAuthn - go use that instead! I have a userbase which really isn't all that inclined to create a secure password for a website. They're also almost ...
0
votes
1answer
182 views

Validating a RSA public key

A a total noob to cryptography. Situation: Given only the public_key i need to know if it is valid; in that, if i use it to encrypt say a form submission, the form data will actually be encrypted. ...
1
vote
2answers
116 views

Can a document be digitally signed multiple times, successively by different users?

The question is, if a document that is collaboratively edited, one user per time, could be digitally signed by every editor before it is passed to the next editor. And if yes, could the final receiver ...
0
votes
1answer
64 views

are session key generated during RSA key exchange mode ephemeral

A cryptographic key is called ephemeral if it is generated for each execution of a key establishment process. We don't we say then that the pre-master secret used in RSA key exchange mode during an ...
0
votes
2answers
1k views

Getting RSA private key from prime1, modulus and publicExponent [duplicate]

I am doing a hacking challenge but I don't manage to know how to decrypt the private key from the public key and the given private key "prime1" parameter. I've seen a private key is composed of : ...
2
votes
1answer
1k views

RSA-1024 vs. DSA-1024: Claim DSA SSH key is much faster to brute force

Does the brute force speed vary significantly between 1024-bit RSA and DSA SSH keys? DSA like gpu keypairs are probably DSA/Elgamal? (Can't find docs) EDIT: The reason I ask is an instructor that "...
1
vote
1answer
183 views

Can we write both encrypted text and plain text to the same file?

We have a requirement from customer to write payment transaction information to a text file. Of many lines of data per transaction, only one line contains cardholder information, which needs ...
0
votes
1answer
79 views

Public key encryption confusion

I'm learning Linux, and currently SSH. But there are details that I don't really understand. I've seen and understood how Diffie-Hellman key exchanges work from a mathematical point of view, but what ...
0
votes
2answers
822 views

What if RSA was broken?

What will happen to web security if RSA was broken (by a new factorization technique) which is used in (ex: digital certificates)? Are there any alternatives to RSA? If there are any alternatives, ...
0
votes
1answer
58 views

Effectiveness of Euler's totient function and Carmichael's totient function in generating the public key in RSA encryption [closed]

I'm a high school student taking IB and for my EE on Maths, I'm comparing the effectiveness of Euler's totient function and Carmichael's totient function in generating the public key in RSA encryption....
4
votes
1answer
5k views

How ECDHE is signed by RSA in ECDHE_RSA cipher

About ciphers that use ECDHE as Key Exchange and RSA as Authentication: How exactly this two algorithms work together, is ECDHE process encrypted by RSA public key? What are the DH parameters? ...
0
votes
1answer
46 views

Server to Server Communication RSA or x509 Certificate

I want to build Server (My) to Server (Other Client parties) web service and I want to add security layer for client verification. Do I need to force clients to create x509 Certificates or RSA key ...
2
votes
0answers
113 views

Attacking a update mechanism using MD5 and RSA

I am currently working on a software challenge where you have to unlock several functions of a piece of software. The software is written in Java. One of them is the update mechanism of the firmware. ...
0
votes
0answers
44 views

Why boxcryptor use hybrid cryptosystem to encrypt files

I do not understand why they need asymmetric key encryption, if the client does not use the public key. As far as I understand it, the user password is used to decrypt the private key and no public ...
2
votes
3answers
5k views

Is allowing root login in SSH with “PermitRootLogin without-password” a secure method?

I have set my live IP in /etc/hosts.allow, and deny all other hosts. I have also set PermitRootLogin without-password in /etc/ssh/sshd_config. Is that a secure method? Can an attacker crack my key ...
0
votes
1answer
2k views

Checking if an RSA private key is passphrase protected

I have generated an RSA key-pair on a computer, and I want to check if the RSA private key is encrypted (protected) with a passphrase. Note that the problem is not that I forgot the passphrase, but ...
0
votes
1answer
50 views

Asymmetric Encryption + Signature workflow

Let´s say that Alice wants to send an encrypted message that only Bob can read, plus confirm that Alice is the person that wrote that message. What is the procedure that will take place? When I see ...