Textbook RSA on random numbers mod a smaller prime

Asked Nov 24 '23 at 22:00

Active Nov 25 '23 at 04:45

Viewed 80 times

I have a protocol where I have a random one-time number message $m \in \mathbb{Z}_p$, where $p$ is a 256 bit prime from an Elliptic Curve (EDIT: The order of an elliptic curve prime order group). I also have a textbook RSA ciphertext $m^e \mod n$, encrypted using a 2048 bit RSA key. I am using for its homomorphic properties (I can't pad it or the protocol will not work).

Is it safe to use using a message from a large message space that is smaller than the RSA group size?

(EDIT in response to comment): I am not stuck with any particular value for $e$, but my program does scale with $\log_2{(e)}$, so I would prefer something smaller.

edited Nov 25 '23 at 04:45

asked Nov 24 '23 at 22:00

Zarquan

Here the value of $e$ is important. If $e=3$ a direct cube-root attack is possible. What is the value of $e$? – kelalaka Nov 24 '23 at 22:34
I'm not bound to any particular value for $e$, though I would prefer for it to not use too many bits. $e = 65537$ should be fine, but I can also go larger if that would be safer. – Zarquan Nov 24 '23 at 23:03
what's a "prime p from an Elliptic curve?" – kodlu Nov 25 '23 at 04:38
What I meant is the prime order from an elliptic curve. – Zarquan Nov 25 '23 at 04:43
2

The present question seems to be a small variation of this one. – fgrieu Nov 25 '23 at 06:39
My question does not depend on a small exponent. If a large value of $e$ mitigates an attack, I can use it. – Zarquan Nov 25 '23 at 16:41

Textbook RSA on random numbers mod a smaller prime

0 Answers0