3 ms·
> The value for public exponent F_4 is actually 65537 ... That's what I thought when I was reading the second post in the thread. I'm certainly no crypto exper
by jlgaddis 9y ago
> The value for public exponent F_4 is actually 65537 ...
That's what I thought when I was reading the second post in the thread. I'm certainly no crypto expert, though, so I was left wondering why 65535 was being recommended when, for example, TLS often uses 65537. I was heading for the DNSSEC RFCs in search of an explanation when I decided to click over to the discussion thread and saw your comment so thank you for the clarification!
EDIT: I'm subscribed to this list so I just posted a "correction" (which is apparently pending moderation, for some reason).
- dfox 9y agoNote that choice of e has no security implications as no valid message can be smaller than length(n)/e. Picking prime speeds up key generation slightly (by eliminating values for which there is no d=e^-1 (mod n), which means that new n or e has to be generated), picking low hamming weight values speeds up public key operations (significantly).
- Dylan16807 9y agoMostly no security implications. e=3 has some doubts. https://crypto.stackexchange.com/questions/8454/what-security-authorities-and-standards-reject-e-3-in-rsa-when-and-with-what https://crypto.stackexchange.com/questions/8454/what-securit... is very informative.
- dfox 9y agoMy comment was meant to say "as long as no valid message", which was intended to imply that for OAEP and PSS it essentially does not matter and for simple padding schemes e has to be sufficiently large (ie. not 3)