Public-Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications Version 2.1

Jönsson, Jakob; Kaliski, Burt

doi:10.17487/rfc3447

Cited by 227 publications

(176 citation statements)

References 24 publications

Supporting

Mentioning

169

Contrasting

Unclassified

Order By: Relevance

“…The only situation we are aware of in which RSA-SCP might have an advantage over FACT-SCP is when the most often executed operation is Express, and deployment of multiprime RSA is acceptable (e.g., N = pqr). Briefly, in the multiprime RSA setting [17,13], private key operations can be implemented particularly efficiently, based on the Chinese Remainder Theorem (CRT). Observe that Definition 8 (in Appendix C) is general enough to cover the multiprime setting.…”

Section: Definition 7 (Sqrt Assumption) For Probabilistic Algorithmsmentioning

confidence: 99%

“…A standard trick [17,6] to speed up private operations in factoring-based schemes is via the Chinese Remainder Theorem (CRT). For instance, if an exponentiation y ← x k mod N is to be computed and the factorization N = pq is known, then y can be obtained by CRTdecomposing x into x p ← x mod p and x q ← x mod q, by computing y p ← x k mod ϕ(p) p mod p and y q ← x k mod ϕ(q) q mod q independently of each other, and by mapping (y p , y q ) back to Z N (by applying the CRT a second time).…”

Section: Implementing Sskgsmentioning

confidence: 99%

See 1 more Smart Citation

Practical Secure Logging: Seekable Sequential Key Generators

Marson

Poettering

2013

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. In computer forensics, log files are indispensable resources that support auditors in identifying and understanding system threats and security breaches. If such logs are recorded locally, i.e., stored on the monitored machine itself, the problem of log authentication arises: if a system intrusion takes place, the intruder might be able to manipulate the log entries and cover her traces. Mechanisms that cryptographically protect collected log messages from manipulation should ideally have two properties: they should be forward-secure (the adversary gets no advantage from learning current keys when aiming at forging past log entries), and they should be seekable (the auditor can verify the integrity of log entries in any order or access pattern, at virtually no computational cost). We propose a new cryptographic primitive, a seekable sequential key generator (SSKG), that combines these two properties and has direct application in secure logging. We rigorously formalize the required security properties and give a provably-secure construction based on the integer factorization problem. We further optimize the scheme in various ways, preparing it for real-world deployment. As a byproduct, we develop the notion of a shortcut one-way permutation (SCP), which might be of independent interest. Our work is highly relevant in practice. Indeed, our SSKG implementation has become part of the logging service of the systemd system manager, a core component of many modern commercial Linux-based operating systems.

show abstract

Section: Definition 7 (Sqrt Assumption) For Probabilistic Algorithmsmentioning

confidence: 99%

Section: Implementing Sskgsmentioning

confidence: 99%

Practical Secure Logging: Seekable Sequential Key Generators

Marson

Poettering

2013

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…This key and its corresponding private key are generated by the client before contacting the server. Implementations of this protocol MUST support RSA keys, in which case the key is a DER-encoded RSAPublicKey as defined in [RFC3447], Section A.1.1, and then it is stored in this octet string in the request. Its encoding as an OCTET STRING starts with the 0x30 byte sequence at the beginning of a DER-encoded RSAPublicKey.…”

Section: Request Packetmentioning

confidence: 99%

kx509 Kerberized Certificate Issuance Protocol in Use in 2012

Allbery¹,

Hotz²

2012

View full text Add to dashboard Cite

“…The "RSA-SHA1" signature method uses the RSASSA-PKCS1-v1_5 signature algorithm as defined in [RFC3447], Section 8.2 (also known as PKCS#1), using SHA-1 as the hash function for EMSA-PKCS1-v1_5. To use this method, the client MUST have established client credentials with the server that included its RSA public key (in a manner that is beyond the scope of this specification).…”

Section: Rsa-sha1mentioning

confidence: 99%

“…The signature base string is signed using the client's RSA private key per [RFC3447], Section 8.2.1:…”

Section: Rsa-sha1mentioning

confidence: 99%