English
Menu

Applied Cryptography

Which of the following correctly describes a problem with using textbook RSA (computing c = m^e mod n directly from the plaintext m) without padding in real communication?

  1. AA ciphertext encrypted with the public key can be decrypted with that same public key alone, without the private key
  2. BBecause the public exponent e is public, the private exponent d can be computed directly from e
  3. CThe same plaintext always gives the same ciphertext, so the plaintext can be guessed by encrypting candidate plaintexts with the public key and comparing
Show answer and explanation

Answer: C. The same plaintext always gives the same ciphertext, so the plaintext can be guessed by encrypting candidate plaintexts with the public key and comparing

Textbook RSA is a deterministic scheme that uses no randomness, so a plaintext with few candidates, such as "yes" or "no", is revealed simply by the attacker encrypting every candidate with the public key and comparing it with the ciphertext. Also, if the plaintext is small, m^e may not exceed n, and taking the e-th root of the ciphertext gives the plaintext. Real RSA encryption adds padding that includes randomness, such as OAEP, before encrypting, and signatures use padding such as PSS. Furthermore, TLS 1.3 removed the method of sending key material encrypted with RSA altogether, and RSA is used only for signatures there.

  • A. Decryption requires the private exponent d; the public key alone cannot decrypt.
  • B. Finding d requires φ(n), that is, the factorization of n, so it cannot be computed even though e is public.
  • C. Correct. Because the scheme is deterministic, an attack that encrypts and compares candidates works.
Practice this topic Back to topic

Books on Applied Cryptography Ad

As an Amazon Associate I earn from qualifying purchases.

More Applied Cryptography questions

  1. In Diffie–Hellman key exchange, a prime p and a generator g are public; A and B choose secret values a and b and send each other g^a mod p and g^b mod p. Which of the following is the reason an eavesdropper is believed unable to find the shared secret g^(ab) mod p even after seeing all these public values?
  2. Diffie–Hellman key exchange is checked with small numbers. Let p = 23 and g = 5; A chooses the secret value a = 6 and B the secret value b = 15. A sends A = g^a mod p and B sends B = g^b mod p. Which of the following is the shared secret the two obtain?
  3. Which of the following is the correct combination of a weakness of Diffie–Hellman key exchange without authentication and its countermeasure?
  4. In the table of NIST SP 800-57, which of the following is the combination of RSA key length (the number of bits of n) and elliptic-curve key length given as the guideline for security comparable to a 128-bit symmetric-key cipher (AES-128)?
  5. In TLS, which of the following key exchange methods provides the property that previously recorded communications cannot be decrypted even if the private key of the server certificate leaks later (forward secrecy)?

Comparisons in this topic