138
The situation can be confused, so let's set things right.
RSA is two algorithms, one for asymmetric encryption, and one for digital signatures. These are two distinct beast; although they share the same core mathematical operation and format for keys, they do different things in different ways. Diffie-Hellman is a key exchange algorithm, which is yet ...
112
Quantum computing will change the encryption game, but it is not yet clear how much it will change. It's not clear because we are not yet certain what sorts of problems quantum computers can solve. As mentioned, RSA is dramatically weakened by quantum computing because the factoring of primes can be done in polynomial time using Shor's Algorithm. However, ...
answered Mar 6 '16 at 0:21
Cort Ammon - Reinstate Monica
8,1103 gold badges21 silver badges24 bronze badges
97
This is a good question. The dedicated page from OpenSSH only says:
OpenSSH 7.0 and greater similarly disables the ssh-dss (DSA) public key algorithm. It too is weak and we recommend against its use.
which is no more detailed than the "inherit weakness" from the announce. I did not find any published explanation about these weaknesses except some ...
68
No, longer is not better.
Let me explain. In symmetric cryptography, keys are just bunches of bits, and all sequences of bits are valid keys. They have no internal structure. Provided that you use decent algorithms, the best possible attack on a key for symmetric encryption is brute force: the attacker tries all possible keys until he finds the right one. ...
64
can I get a public key?
It's easy using openssl rsa:
$ openssl rsa -in the-private-key-from-your-question.pem -pubout
writing RSA key
-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCtrKVnwse4anfX+JzM7imShXZU
C+QBXQ11A5bOWwHFkXc4nTfEOr3fJjnRSU5A3IROFU/pVVNiXJNkl7qQZK5mYb8j
3NgqX8zZJG7IwLJ/Pm2sRW5Qj32C/uJum64Q/iEIsCg/mJjDLh1lylEMEuzKgTdW
...
60
RSA, as defined by PKCS#1, encrypts "messages" of limited size. With the commonly used "v1.5 padding" and a 2048-bit RSA key, the maximum size of data which can be encrypted with RSA is 245 bytes. No more.
When you "encrypt data with RSA", in practice, you are actually encrypting a random symmetric key with RSA, and then encrypt the data with a symmetric ...
57
Key strengths, and their equivalences, become meaningless when they reach the zone of "cannot be broken with existing and foreseeable technology", because there is no such thing as more secure than that. It is a common reflex to try to think of key sizes as providing some sort of security margin, but this kind of reasoning fails beyond some point.
Basically,...
56
If the attacker is able to passively capture data and later gets access to the private key of the certificates (i.e. stealing, heartbleed attack or law enforcement), then the attacker could decode all previously captured data if the encryption key is only derived from the certificate itself.
DH key exchange makes it possible to create a key independent from ...
44
Neither, unless it's both. You're asking the wrong question. You should not be thinking about a cryptographic algorithm at this stage, but about a cryptographic protocol.
Cryptographic protocols are hard to design, and a frequent source of security bugs. You don't fully understand public-key cryptography, so you aren't ready to use it in your own ...
answered Jan 23 '12 at 17:43
Gilles 'SO- stop being evil'
43.2k13 gold badges103 silver badges157 bronze badges
42
Testing for primality is much easier than performing integer factorization.
There are several ways to test for primality, such as the deterministic Sieve of Eratosthenes and the probabilistic Miller–Rabin primality tests. OpenSSL uses several tests to check for primality. First they subject the number to the deterministic checks, attempting division of the ...
39
Comparing the two directly is a little like comparing a tractor to a train - they're both vehicles but have completely different function and construction.
RSA is an asymmetric cipher. It is ideal for secure exchange of messages across an untrusted network, because the public key can be known by everyone - a message encrypted with the public key can only be ...
37
since it's known that the NSA infiltrated RSA and made their key generation algorithm weaker
If you know that, then you know wrong. You are confusing two things which have no relation whatsoever:
RSA, the asymmetric cryptographic algorithm.
Dual_EC_DRBG, a PRNG algorithm of poor quality and amenable to backdooring.
RSA can be used for asymmetric ...
36
"Textbook"/"raw"/"unpadded" RSA has an "oops, the real world happened" problem.
Consider any RSA key whose modulus is 4096-bit. It should be nearly impossible for someone to recover a message encrypted under that key, right? Let's assume that this key has a public exponent value (e) of 3.
If Alice uses this public key to encrypt the message "No" to Bob she ...
34
RSA isn't really built to encrypt large pieces of plaintext. Each RSA "round" can encrypt 117 bytes of data, and to encrypt more, you'd have to use some chaining mode. Currently, this means extra overhead, slowness (remember, RSA is pretty slow), and security uncertainty (RSA-chaningMode hasn't been scrutinized as other types of encryption schemes). <- ...
34
First, what matters is not having two identical private keys, if either of the prime numbers is the same in the modulus (which is part of the public key), it is easy to quickly recover the full private key.
(Aside -- Brief RSA primer: In RSA for an n-bit private key, the public key is composed of an exponent, typically e=65537 and a modulus, N, which is ...
34
RSA is two algorithms, one for asymmetric encryption, the other one for digital signatures. They use the same kind of keys, they share the same core operation, and they are both called "RSA".
Diffie-Hellman is a key exchange algorithm; you can view it as a kind of asymmetric encryption algorithm where you do not get to choose what you encrypt. This is fine ...
34
All of the weaknesses in your protocol can be summed up as "use SSL" or even "use SSL, dammit !".
In more details:
All the protocol is of course vulnerable to impersonation, specifically the double impersonation that is also known as Man-in-the-Middle attack.
Similarly, if any of potential attackers that can eavesdrop on the line decides to do a ...
32
Yes it does work as you say. The chip is "tamper resistant" and will erase the "seed" (secret key) if any attempt is made to attack it. This is often accomplished by having a non-user-replaceable battery and a "trap" that breaks power to the device once the device is opened, or the chip surface is removed. The key is then stored in a SRAM, requiring power to ...
31
They're not really directly comparable. The number commonly bandied about is 2048-bit RSA is about equivalent to 128-bit AES. But that number shouldn't be relied on without understanding the caveats.
Currently the most effective way of breaking AES crypto (and any other unbroken symmetric cipher, for that matter) is brute-force. You simply try every ...
30
Start with saving the three parts respectively to pub.b64, priv.b64 and blob.b64:
$ base64 -d < pub.b64 | openssl asn1parse -inform DER -i
0:d=0 hl=3 l= 158 cons: SEQUENCE
3:d=1 hl=2 l= 13 cons: SEQUENCE
5:d=2 hl=2 l= 9 prim: OBJECT :rsaEncryption
16:d=2 hl=2 l= 0 prim: NULL
18:d=1 hl=3 l= 140 prim: BIT ...
28
The host key is used to sign the Diffie-Hellman parameters. It is used during the key exchange; RSA is a signature algorithm as well as an encryption algorithm. From what I can tell, the client key (in authorized_keys) is not used in key exchange at all; it's only used after key exchange to sign a particular message and prove the client has the private key (...
27
In practice, yes, you can get the public key from the private key.
In principle, it would be possible to create an RSA private key from which the corresponding public key cannot be easily obtained, but this would require using both a non-standard key generation method and a non-standard private key storage format.
Let's quickly review the basics. An RSA ...
26
There might be a bit of confusion here between "RSA Laboratories", the organization that edits the PKCS standards, and RSA, the cryptographic algorithm. PKCS#1 is one of the PKCS standards, thus edited by RSA Laboratories; it talks about the algorithm RSA, and only about the RSA algorithm.
In particular, there is no such thing as a "PKCS#1 format" for ...
26
> I saw different key sizes for RSA algorithm (512, 1024,... [bits] for example) but, is this the length of public key or the length of private key or both are equal in length?
It's the length of the modulus used to compute the RSA key pair. The public key is made of modulus and public exponent, while the private key is made of modulus and private exponent....
25
It is not the length of the passphrase which matters, but its randomness; namely, how much different it could have been. Length makes room for randomness, but does not generate it.
Symmetric encryption of SSH private keys is not very well designed; it relies on some old features of OpenSSL, which date from before password hashing was a properly understood ...
25
Making your own crypto is fine as long as you understand that it is for learning, not for using.
There are several "layers" in cryptography. There are algorithms, like RSA, AES, SHA-256... Then there are protocols, which assemble algorithms together. And then, there are implementations, which turn protocols into executable code. For a first grasp of ...
21
One bit can be 0 (zero) or 1 (one). So 2048 bits gives 2^2048 distinct numbers. A decimal digit has ten possible values 0, 1, 2, ... , 9. So to find the number of decimal digits to make 2^2048 distinct number we need to solve
2^2048 = 10^n
Take a logarithm (base 10) on both sides to get
2048 log(2) = n log(10)
I.e.
n = 2048log(2) = 616.5
which means ...
21
Yes, the same RSA key pair can be used for both (Open)SSL and OpenPGP/GnuPG.
The monkeysphere project contains a tool to convert RSA keys in PEM format to the one defined by OpenPGP, pem2openpgp. For converting the SSH key pair into the PEM format, there already is a comprehensive answer in Converting keys between openssl and openssh.
20
Yes. The first problem is that you are writing your own crypto protocol. Please don't do that. Use TLS or SSH instead.
Second, there are many books written about writing secure protocols, and even common problems in protocols. Your algorithm has them.
Third, you do nothing about out of order traffic, modified messages (you mention encryption but you don'...
19
DH ephemeral key exchange provides perfect forward secrecy, which RSA alone does not. This means that even if the long-term key is leaked at a later date, the session keys for individual connections are not compromised, even if the full data stream is captured.
Only top voted, non community-wiki answers of a minimum length are eligible
