5 ms·
Yeah, when I originally read about this I thought more or less the same thing. A low amount of entropy is already assumed in various attacks (like dictionary at
by anaphor 13y ago
Yeah, when I originally read about this I thought more or less the same thing. A low amount of entropy is already assumed in various attacks (like dictionary attacks), or even just guessing based on your knowledge of the person who created the password, it's the same deal. I don't see how you can assume the same thing for RSA keypairs though...
- betterunix 13y agoSlightly off topic, but low-entropy during RSA key generation is a serious problem: https://factorable.net/weakkeys12.extended.pdf https://factorable.net/weakkeys12.extended.pdf
- anaphor 13y agoYeah, I meant that it's not exactly the same level. Certain implementations of RSA were using broken sources of entropy, but it's not the same as "Bob always uses his address as his password" which has no entropy.
- betterunix 13y agoOK, sure, but if you want something more to do with ciphertexts than with key generation, consider this: "textbook" RSA is not secure. The reason is that the "textbook" RSA algorithm is not randomized; that is also the reason why so much effort has gone into randomized padding schemes like this: https://en.wikipedia.org/wiki/OAEP https://en.wikipedia.org/wiki/OAEP