Given N and e in RSA and the ability to get signature s for any message m ($s=m^d \mod{n}$), can you find the value of the private key d?
Asked
Active
Viewed 209 times
1
-
Did you search on our site? Are you asking for a TextBook signature that is already insecure? Or are you asking for RSA-PSS? Note that signature requires hashing of the message since the first true Rabin Signature Scheme, – kelalaka May 25 '21 at 14:10
-
@kelalaka on the site I found this https://crypto.stackexchange.com/questions/9896/how-does-rsa-signature-verification-work that shows how to find a signature m without d and I also found how to find N without having it initially, but I haven't found how to work out d given N and e and the ability to find the signature for any message m. The signature I'm talking about is $s=m^d\mod{n}$ and you can modify m to any value you like and receive the value of $s$ – Michael Blane May 25 '21 at 14:12
-
Nope, signature requires the private key. – kelalaka May 25 '21 at 14:38
-
You're right I mad an error again :) I think I'm tired – Michael Blane May 25 '21 at 14:39
-
1Hint: If you can find, then you can solve factorisation problem, too – kelalaka May 25 '21 at 14:44
-
so basically then there is no known method to get d right @kelalaka – Michael Blane May 25 '21 at 14:47
-
Does this answer about chosen-plaintext and -ciphertext attacks, or this question about textbook chosen-plaintext attacks cover your use-case? – JamesTheAwesomeDude May 25 '21 at 16:46
-
1@JamesTheAwesomeDude those are about encryption, the question is about the signature. – kelalaka May 25 '21 at 17:11
-
@kelalaka I thought those are the same thing? "signing" a message [digest] is just encrypting it with the "wrong half" of the key – JamesTheAwesomeDude May 25 '21 at 17:14
-
$e$ is known so you can play the CPA, CCA games. $d$ is secret. They are not, both require different security requirements and padding to achieve that. Read the latest answer to the link you gave. The main objective in the signature is forging. – kelalaka May 25 '21 at 17:58
-
@JamesTheAwesomeDude Please have a look at this. Although in fairness, the question is about textbook RSA without any padding or conversions; my Q/A is not much about textbook RSA. But please, do not confuse signature generation as "encryption with the private key", there is really no such thing. – Maarten Bodewes Jun 01 '21 at 22:27