RSA2048 smallest possible module












1














what is the smallest possible module for RSA2048? I generate a random data with I want to encrypt by a textbook RSA2048 and I'm not sure where the first 1-bit should be.



According to OpenSSL source code and used padding function, the first byte seems to be 0, 2 follows and than there could be anything. Seems I need first 14bits to be 0 to ensure my plaintext fits the RSA module.



Thanks






rsa







share|improve this question


















  • 1




    what you mean by smallest module? See this:
    – kelalaka
    2 hours ago










  • c^e mod m. The m is module/modulus?
    – smrt28
    2 hours ago






  • 1




    What is the reason other than curiosity? do you need to find $n=pq$ where two $p$ and $q$ are two primes such that $n$ is the smallest possible 2048-bit integer?
    – kelalaka
    2 hours ago










  • No, the RSA2048 key is just a common OpenSSL generated key. I need to generate c that way I can be sure c < m and can be used as a plaintext RSA2048 input in general.
    – smrt28
    2 hours ago










  • For text book RSA every $m in mathbb{Z}_n$ is valid. For padded RSA see the link that I provided in the first comment.
    – kelalaka
    2 hours ago


















1














what is the smallest possible module for RSA2048? I generate a random data with I want to encrypt by a textbook RSA2048 and I'm not sure where the first 1-bit should be.



According to OpenSSL source code and used padding function, the first byte seems to be 0, 2 follows and than there could be anything. Seems I need first 14bits to be 0 to ensure my plaintext fits the RSA module.



Thanks






rsa







share|improve this question


















  • 1




    what you mean by smallest module? See this:
    – kelalaka
    2 hours ago










  • c^e mod m. The m is module/modulus?
    – smrt28
    2 hours ago






  • 1




    What is the reason other than curiosity? do you need to find $n=pq$ where two $p$ and $q$ are two primes such that $n$ is the smallest possible 2048-bit integer?
    – kelalaka
    2 hours ago










  • No, the RSA2048 key is just a common OpenSSL generated key. I need to generate c that way I can be sure c < m and can be used as a plaintext RSA2048 input in general.
    – smrt28
    2 hours ago










  • For text book RSA every $m in mathbb{Z}_n$ is valid. For padded RSA see the link that I provided in the first comment.
    – kelalaka
    2 hours ago
















1












1








1







what is the smallest possible module for RSA2048? I generate a random data with I want to encrypt by a textbook RSA2048 and I'm not sure where the first 1-bit should be.



According to OpenSSL source code and used padding function, the first byte seems to be 0, 2 follows and than there could be anything. Seems I need first 14bits to be 0 to ensure my plaintext fits the RSA module.



Thanks






rsa







share|improve this question













what is the smallest possible module for RSA2048? I generate a random data with I want to encrypt by a textbook RSA2048 and I'm not sure where the first 1-bit should be.



According to OpenSSL source code and used padding function, the first byte seems to be 0, 2 follows and than there could be anything. Seems I need first 14bits to be 0 to ensure my plaintext fits the RSA module.



Thanks






rsa




rsa






share|improve this question













share|improve this question











share|improve this question




share|improve this question










asked 2 hours ago









smrt28

52848




52848








  • 1




    what you mean by smallest module? See this:
    – kelalaka
    2 hours ago










  • c^e mod m. The m is module/modulus?
    – smrt28
    2 hours ago






  • 1




    What is the reason other than curiosity? do you need to find $n=pq$ where two $p$ and $q$ are two primes such that $n$ is the smallest possible 2048-bit integer?
    – kelalaka
    2 hours ago










  • No, the RSA2048 key is just a common OpenSSL generated key. I need to generate c that way I can be sure c < m and can be used as a plaintext RSA2048 input in general.
    – smrt28
    2 hours ago










  • For text book RSA every $m in mathbb{Z}_n$ is valid. For padded RSA see the link that I provided in the first comment.
    – kelalaka
    2 hours ago
















  • 1




    what you mean by smallest module? See this:
    – kelalaka
    2 hours ago










  • c^e mod m. The m is module/modulus?
    – smrt28
    2 hours ago






  • 1




    What is the reason other than curiosity? do you need to find $n=pq$ where two $p$ and $q$ are two primes such that $n$ is the smallest possible 2048-bit integer?
    – kelalaka
    2 hours ago










  • No, the RSA2048 key is just a common OpenSSL generated key. I need to generate c that way I can be sure c < m and can be used as a plaintext RSA2048 input in general.
    – smrt28
    2 hours ago










  • For text book RSA every $m in mathbb{Z}_n$ is valid. For padded RSA see the link that I provided in the first comment.
    – kelalaka
    2 hours ago










1




1




what you mean by smallest module? See this:
– kelalaka
2 hours ago




what you mean by smallest module? See this:
– kelalaka
2 hours ago












c^e mod m. The m is module/modulus?
– smrt28
2 hours ago




c^e mod m. The m is module/modulus?
– smrt28
2 hours ago




1




1




What is the reason other than curiosity? do you need to find $n=pq$ where two $p$ and $q$ are two primes such that $n$ is the smallest possible 2048-bit integer?
– kelalaka
2 hours ago




What is the reason other than curiosity? do you need to find $n=pq$ where two $p$ and $q$ are two primes such that $n$ is the smallest possible 2048-bit integer?
– kelalaka
2 hours ago












No, the RSA2048 key is just a common OpenSSL generated key. I need to generate c that way I can be sure c < m and can be used as a plaintext RSA2048 input in general.
– smrt28
2 hours ago




No, the RSA2048 key is just a common OpenSSL generated key. I need to generate c that way I can be sure c < m and can be used as a plaintext RSA2048 input in general.
– smrt28
2 hours ago












For text book RSA every $m in mathbb{Z}_n$ is valid. For padded RSA see the link that I provided in the first comment.
– kelalaka
2 hours ago






For text book RSA every $m in mathbb{Z}_n$ is valid. For padded RSA see the link that I provided in the first comment.
– kelalaka
2 hours ago












1 Answer
1






active

oldest

votes


















2














The modulus defines the key length for RSA. So a 2048 bit key has a 1 at the leftmost bit. Otherwise there could be almost any number of zero's following it, each zero becoming less likely, as the modulus value depends on two large random primes - usually in the order of half the bit size of the modulus. So if you want to take a minimum modulus $N$ into account, you can have any 2047 bit message for plaintext RSA - as long as the most significant bit of the most significant byte is zero (commonly RSA uses big endian calculations, so that would be the highest order bit of the leftmost byte).



But please note that plaintext RSA is insecure; the security of the scheme would depend on the content of the message. If it by chance is a fully OAEP padded message then it is certainly secure if verified correctly, but I'm not sure you would implement a secure scheme by chance. Actually, I would consider it highly unlikely that a scheme would survive even the simplest of plaintext oracle attacks.






share|improve this answer





















  • The idea is to generate longest possible ciphertext from password by PBKF2, use Yubikey to decrypt the random-like data, and use another PBKF2 from those "decrypted" data as a key for LUKS disk encryption.
    – smrt28
    2 hours ago










  • ...the idea is to protect the LUKS crypto-key by the PIN. This would be a workaround, since I haven't found any way how to store arbitrary data on Yubikey protected by PIN.
    – smrt28
    1 hour ago










  • That sounds as properly randomized data. However, I don't see any reason to store more than the output of the hash size. In that case you can still wrap it in a secure scheme such as OAEP. Storing more than the hash size for PBKDF2 actually could shift the advantage to an adversary - although if you feed it directly into another KDF I guess that's not as likely to happen. Still, outputting more than a single hash doesn't make PBKDF2 any more secure; the hash size is still the limiting factor.
    – Maarten Bodewes♦
    1 hour ago











Your Answer





StackExchange.ifUsing("editor", function () {
return StackExchange.using("mathjaxEditing", function () {
StackExchange.MarkdownEditor.creationCallbacks.add(function (editor, postfix) {
StackExchange.mathjaxEditing.prepareWmdForMathJax(editor, postfix, [["$", "$"], ["\\(","\\)"]]);
});
});
}, "mathjax-editing");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "281"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});














draft saved

draft discarded


















StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f66198%2frsa2048-smallest-possible-module%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown

























1 Answer
1






active

oldest

votes








1 Answer
1






active

oldest

votes









active

oldest

votes






active

oldest

votes









2














The modulus defines the key length for RSA. So a 2048 bit key has a 1 at the leftmost bit. Otherwise there could be almost any number of zero's following it, each zero becoming less likely, as the modulus value depends on two large random primes - usually in the order of half the bit size of the modulus. So if you want to take a minimum modulus $N$ into account, you can have any 2047 bit message for plaintext RSA - as long as the most significant bit of the most significant byte is zero (commonly RSA uses big endian calculations, so that would be the highest order bit of the leftmost byte).



But please note that plaintext RSA is insecure; the security of the scheme would depend on the content of the message. If it by chance is a fully OAEP padded message then it is certainly secure if verified correctly, but I'm not sure you would implement a secure scheme by chance. Actually, I would consider it highly unlikely that a scheme would survive even the simplest of plaintext oracle attacks.






share|improve this answer





















  • The idea is to generate longest possible ciphertext from password by PBKF2, use Yubikey to decrypt the random-like data, and use another PBKF2 from those "decrypted" data as a key for LUKS disk encryption.
    – smrt28
    2 hours ago










  • ...the idea is to protect the LUKS crypto-key by the PIN. This would be a workaround, since I haven't found any way how to store arbitrary data on Yubikey protected by PIN.
    – smrt28
    1 hour ago










  • That sounds as properly randomized data. However, I don't see any reason to store more than the output of the hash size. In that case you can still wrap it in a secure scheme such as OAEP. Storing more than the hash size for PBKDF2 actually could shift the advantage to an adversary - although if you feed it directly into another KDF I guess that's not as likely to happen. Still, outputting more than a single hash doesn't make PBKDF2 any more secure; the hash size is still the limiting factor.
    – Maarten Bodewes♦
    1 hour ago
















2














The modulus defines the key length for RSA. So a 2048 bit key has a 1 at the leftmost bit. Otherwise there could be almost any number of zero's following it, each zero becoming less likely, as the modulus value depends on two large random primes - usually in the order of half the bit size of the modulus. So if you want to take a minimum modulus $N$ into account, you can have any 2047 bit message for plaintext RSA - as long as the most significant bit of the most significant byte is zero (commonly RSA uses big endian calculations, so that would be the highest order bit of the leftmost byte).



But please note that plaintext RSA is insecure; the security of the scheme would depend on the content of the message. If it by chance is a fully OAEP padded message then it is certainly secure if verified correctly, but I'm not sure you would implement a secure scheme by chance. Actually, I would consider it highly unlikely that a scheme would survive even the simplest of plaintext oracle attacks.






share|improve this answer





















  • The idea is to generate longest possible ciphertext from password by PBKF2, use Yubikey to decrypt the random-like data, and use another PBKF2 from those "decrypted" data as a key for LUKS disk encryption.
    – smrt28
    2 hours ago










  • ...the idea is to protect the LUKS crypto-key by the PIN. This would be a workaround, since I haven't found any way how to store arbitrary data on Yubikey protected by PIN.
    – smrt28
    1 hour ago










  • That sounds as properly randomized data. However, I don't see any reason to store more than the output of the hash size. In that case you can still wrap it in a secure scheme such as OAEP. Storing more than the hash size for PBKDF2 actually could shift the advantage to an adversary - although if you feed it directly into another KDF I guess that's not as likely to happen. Still, outputting more than a single hash doesn't make PBKDF2 any more secure; the hash size is still the limiting factor.
    – Maarten Bodewes♦
    1 hour ago














2












2








2






The modulus defines the key length for RSA. So a 2048 bit key has a 1 at the leftmost bit. Otherwise there could be almost any number of zero's following it, each zero becoming less likely, as the modulus value depends on two large random primes - usually in the order of half the bit size of the modulus. So if you want to take a minimum modulus $N$ into account, you can have any 2047 bit message for plaintext RSA - as long as the most significant bit of the most significant byte is zero (commonly RSA uses big endian calculations, so that would be the highest order bit of the leftmost byte).



But please note that plaintext RSA is insecure; the security of the scheme would depend on the content of the message. If it by chance is a fully OAEP padded message then it is certainly secure if verified correctly, but I'm not sure you would implement a secure scheme by chance. Actually, I would consider it highly unlikely that a scheme would survive even the simplest of plaintext oracle attacks.






share|improve this answer












The modulus defines the key length for RSA. So a 2048 bit key has a 1 at the leftmost bit. Otherwise there could be almost any number of zero's following it, each zero becoming less likely, as the modulus value depends on two large random primes - usually in the order of half the bit size of the modulus. So if you want to take a minimum modulus $N$ into account, you can have any 2047 bit message for plaintext RSA - as long as the most significant bit of the most significant byte is zero (commonly RSA uses big endian calculations, so that would be the highest order bit of the leftmost byte).



But please note that plaintext RSA is insecure; the security of the scheme would depend on the content of the message. If it by chance is a fully OAEP padded message then it is certainly secure if verified correctly, but I'm not sure you would implement a secure scheme by chance. Actually, I would consider it highly unlikely that a scheme would survive even the simplest of plaintext oracle attacks.







share|improve this answer












share|improve this answer



share|improve this answer










answered 2 hours ago









Maarten Bodewes♦

52.9k677191




52.9k677191












  • The idea is to generate longest possible ciphertext from password by PBKF2, use Yubikey to decrypt the random-like data, and use another PBKF2 from those "decrypted" data as a key for LUKS disk encryption.
    – smrt28
    2 hours ago










  • ...the idea is to protect the LUKS crypto-key by the PIN. This would be a workaround, since I haven't found any way how to store arbitrary data on Yubikey protected by PIN.
    – smrt28
    1 hour ago










  • That sounds as properly randomized data. However, I don't see any reason to store more than the output of the hash size. In that case you can still wrap it in a secure scheme such as OAEP. Storing more than the hash size for PBKDF2 actually could shift the advantage to an adversary - although if you feed it directly into another KDF I guess that's not as likely to happen. Still, outputting more than a single hash doesn't make PBKDF2 any more secure; the hash size is still the limiting factor.
    – Maarten Bodewes♦
    1 hour ago


















  • The idea is to generate longest possible ciphertext from password by PBKF2, use Yubikey to decrypt the random-like data, and use another PBKF2 from those "decrypted" data as a key for LUKS disk encryption.
    – smrt28
    2 hours ago










  • ...the idea is to protect the LUKS crypto-key by the PIN. This would be a workaround, since I haven't found any way how to store arbitrary data on Yubikey protected by PIN.
    – smrt28
    1 hour ago










  • That sounds as properly randomized data. However, I don't see any reason to store more than the output of the hash size. In that case you can still wrap it in a secure scheme such as OAEP. Storing more than the hash size for PBKDF2 actually could shift the advantage to an adversary - although if you feed it directly into another KDF I guess that's not as likely to happen. Still, outputting more than a single hash doesn't make PBKDF2 any more secure; the hash size is still the limiting factor.
    – Maarten Bodewes♦
    1 hour ago
















The idea is to generate longest possible ciphertext from password by PBKF2, use Yubikey to decrypt the random-like data, and use another PBKF2 from those "decrypted" data as a key for LUKS disk encryption.
– smrt28
2 hours ago




The idea is to generate longest possible ciphertext from password by PBKF2, use Yubikey to decrypt the random-like data, and use another PBKF2 from those "decrypted" data as a key for LUKS disk encryption.
– smrt28
2 hours ago












...the idea is to protect the LUKS crypto-key by the PIN. This would be a workaround, since I haven't found any way how to store arbitrary data on Yubikey protected by PIN.
– smrt28
1 hour ago




...the idea is to protect the LUKS crypto-key by the PIN. This would be a workaround, since I haven't found any way how to store arbitrary data on Yubikey protected by PIN.
– smrt28
1 hour ago












That sounds as properly randomized data. However, I don't see any reason to store more than the output of the hash size. In that case you can still wrap it in a secure scheme such as OAEP. Storing more than the hash size for PBKDF2 actually could shift the advantage to an adversary - although if you feed it directly into another KDF I guess that's not as likely to happen. Still, outputting more than a single hash doesn't make PBKDF2 any more secure; the hash size is still the limiting factor.
– Maarten Bodewes♦
1 hour ago




That sounds as properly randomized data. However, I don't see any reason to store more than the output of the hash size. In that case you can still wrap it in a secure scheme such as OAEP. Storing more than the hash size for PBKDF2 actually could shift the advantage to an adversary - although if you feed it directly into another KDF I guess that's not as likely to happen. Still, outputting more than a single hash doesn't make PBKDF2 any more secure; the hash size is still the limiting factor.
– Maarten Bodewes♦
1 hour ago


















draft saved

draft discarded




















































Thanks for contributing an answer to Cryptography Stack Exchange!


  • Please be sure to answer the question. Provide details and share your research!

But avoid …



  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.


Use MathJax to format equations. MathJax reference.


To learn more, see our tips on writing great answers.





Some of your past answers have not been well-received, and you're in danger of being blocked from answering.


Please pay close attention to the following guidance:


  • Please be sure to answer the question. Provide details and share your research!

But avoid …



  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.


To learn more, see our tips on writing great answers.




draft saved


draft discarded














StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcrypto.stackexchange.com%2fquestions%2f66198%2frsa2048-smallest-possible-module%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown







-

Popular posts from this blog

Scott Moir

Image
Scott Moir Tessa Virtue i Scott Moir w 2016 r. Reprezentacja   Kanada Data i miejsce urodzenia 2 września 1987 London Wzrost 180 cm Konkurencja Pary taneczne Partner sportowy Tessa Virtue Trener Marie-France Dubreuil, Patrice Lauzon, Romain Haguenauer Poprzednio: Marina Zujewa, Oleg Epstein, Igor Szpilband, Johnny Johns, Carol Moir, Paul MacIntosh, Suzanne Killing Klub Montreal International School of Skating Poprzednio: Arctic Edge FSC Ilderton Skating Club Lokalizacja treningowa Montreal Poprzednio: Canton Kitchener Rekordy życiowe ISU przed sezonem 2018/2019 Nota łączna 206,07 Igrzyska Olimpijskie 2018 Taniec krótki 83,67 Igrzyska Olimpijskie 2018 Taniec dowolny 122,40 Igrzyska Olimpijskie 2018 Dorobek medalowy Reprezentacja   Kanada Igrzyska olimpijskie Złoto Vancouver 2010 pary taneczne Złoto Pjongczang 2018 pary taneczne Złoto Pjongczang 2018 drużynowo Srebro S...
Read more

Souastre

Image
Souastre — miejscowość i gmina — Herb Państwo   Francja Region Hauts-de-France Departament Pas-de-Calais Okręg Arras Kod INSEE 62800 Powierzchnia 7,18 km² Populacja  (1990) • liczba ludności 352 • gęstość 49 os./km² Kod pocztowy 62111 Położenie na mapie Francji Souastre 50°09′N   2°34′E / 50,150000   2,566667 Portal Francja Souastre – miejscowość i gmina we Francji, w regionie Hauts-de-France, w departamencie Pas-de-Calais. Według danych na rok 1990 gminę zamieszkiwały 352 osoby, a gęstość zaludnienia wynosiła 49 osób/km² (wśród 1549 gmin regionu Nord-Pas-de-Calais Souastre plasuje się na 887. miejscu pod względem liczby ludności, natomiast pod względem powierzchni na miejscu 507.). Bibliografia | Francuski urząd statystyczny ( fr. ) . p   •   d   •   e Gminy okręgu Arras Ablain-Saint-Nazaire Ablainzevelle Acheville Achicourt Achiet-le-Grand Achiet-le-Pe...
Read more

Morgemoulin

Image
Morgemoulin — miejscowość i gmina — Państwo   Francja Region Grand Est Departament Moza Okręg Verdun Kod INSEE 55357 Powierzchnia 6,82 km² Populacja  (1990) • liczba ludności 75 • gęstość 11 os./km² Kod pocztowy 55400 Położenie na mapie Francji Morgemoulin 49°14′N   5°35′E / 49,233333   5,583333 Portal Francja Morgemoulin – miejscowość i gmina we Francji, w regionie Grand Est, w departamencie Moza. Według danych na rok 1990 gminę zamieszkiwało 75 osób, a gęstość zaludnienia wynosiła 11 osób/km² (wśród 2335 gmin Lotaryngii Morgemoulin plasuje się na 970. miejscu pod względem liczby ludności, natomiast pod względem powierzchni na miejscu 848.). Bibliografia | Francuski urząd statystyczny ( fr. ) . p   •   d   •   e Gminy okręgu Verdun Abaucourt-Hautecourt • Aincreville • Ambly-sur-Meuse • Amel-sur-l'Étang • Ancemont • Arrancy-sur-Crusne • Aubréville • Autré...
Read more