Talk:Rabin cryptosystem

message: *Article: :de:Rabin-Kryptosystem (merge into our stubby Rabin cryptosystem)
*Corresponding English-language article: merge into our stubby Rabin cryptosystem
* Originally Requested by: — Matt 18:12, 27 Jul 2004 (UTC)

message: If the message m squared m*m is smaller than n, since m can be calculated as the square root (without remainder) independend of n, p and q. In such a case the encryption is not secure at all. 109.90.224.162 (talk) 15:04, 21 September 2015 (UTC)
thread_title:  Only the signature, not encryption is as secure as integer factorization 

message: As discussed in other sections of this discussion page, it is not exactly clear, why a chosen ciphertext attack should break the Rabin Cryptosystem.<BR>
To shed some light on what Michael Rabin wrote in his original paper and what exactly the problem is, I propose to include a subsection under "Evaluation", which explains how finding square roots is connected to factoring the public key. I propose to use an example based on the two prime numbers "p=19","q=23","n=p*q=323". Rough outline:<BR>
* Start with "k*k = s  mod n", that means that "k" is one of the square roots of "s".
* "n-k" is another square root of "s", because "(-k)*(-k) = s  mod n". So "-k = n-k mod n" is the second square root of "s".
* Now from Rabins paper we know, that there has to be another number "h", with "h != k mod n" and "h != -k mod n", so that "h*h = s  mod n".<BR> This "h" is the third square root of "s".
* "-h" is the fourth square root of "s".
* Rabin shows that if you can find two square roots "k" and "h", with "h != k mod n" and "h != -k mod n", then you can very easily calculate "p" and "q", because:<BR> either "gcd(k-h,n) = p" or "gcd(k-h,n) = q". (gcd here means Greatest common divisor).
* Example: "p=19,q=23,n=p*q=437". "s=233", "k=200, -k=237", "h=85, -h=352". (Simple check: "k*k mod n = 200*200 mod 437 = 233 = s")<BR>"k-h=200-85=115", "gcd(115,437) = 23 = q", voila we found one of the two prime factors.
* Consequences:
** Any attacker can create pairs of "k" and "s": Simply randomly generate a "k" and calculate "s = k*k mod n" ("n" is public).
** If an attacker can additionally find "h" with "h != k mod n" and "h != -k mod n", the attacker is able to find "p" and "q".<BR> This is exactly what Rabin proves in his paper: Finding square roots "mod n" is as hard as factoring "n", because if you have the square roots you can efficiently calculate the prime factors of "n". Note: This of course applies to any cryptosystem, which relies on the assumption that factoring is hard (like for example this also applies to RSA).
** What has to be avoided at all costs is, that the owner of the private key ("p" and "q") calculates such a "h" ("h*h = s mod n, h != k mod n, h != -k mod n") and sends it back to the attacker. If this should ever happen, the attacker can easily calculate "p" and "q" as shown before.
** Possible threat: There exist "h" for which "h*h = s" with "1<=s<n" (important here, no "mod n"!). You can calculate "h" from "s" easily in this case (simple integer square root algorithm). When using Rabins Cryptosystem for signatures the signer should make sure that the signature "k", with "k*k = s mod n" does not produce a "s" which has an integer square root; of course the probability that this ever happens is minuscule and can be easily avoided completely. Again all this applies to any cryptosystem based on prime factors: An attacker can always create a huge amount of random "k*k = s mod n" pairs and check if "s" has an integer square root; this is just a randomized way to factor "n".
In my opinion the last two points are, why some people seem to say that Rabins Cryptosystem is vulnerable. But of course this is only true, if you construct the protocol in such a way, that the owner of the private key does send back the critical "h" square root. This can be easily avoided or at least I really cannot think of any scenario in which it cannot be avoided. Of course in a way this means that Rabins Cryptosystem is more "sensitive" (lack of a better word) in a manner than RSA: 
* Rabin: If you have a "ciphertext(s) <-> plaintext(k)" pair, then there exists an alternative "plaintext(h)" which MUST NOT be revealed by the owner of the private key. (Revealing a stand-alone "ciphertext(s) <-> plaintext(k)" pair DOES NOT break anything!). 
* RSA: There are only pairs of "ciphertext <-> plaintext" and no alternative "plaintext" exists. Revealing such a "ciphertext <-> plaintext" pair does not break anything. 
Note under the "Security" section it says that: "(This assumes that the plaintext was not created with a specific structure to ease decoding.)". If you read what I wrote above, this quote is nonsense: ANY plaintext "k" (regardless of structure) produces a ciphertext "s" with "s = k*k mod n". If an attacker can find the an alternative plaintext "h", so that "h != k mod n" and "h != -k mod n", the cipher has been broken; this is true for ALL plaintexts "k", so why has that anything to do with the structure of the plaintext ? Lundril (talk) 13:26, 14 September 2011 (UTC)
thread_title:  Evaluation , a proposal 

message: Rabin cryptosystem is not a permutation, so there may be issues when used for pubkey encryption, but there should not when used in signature schemes. Can somebody write something about this?
: answering to myself... Ok, Rabin is totally insecure as a signature scheme under CCA.  —Preceding unsigned comment added by 85.124.63.18 (talk) 23:03, 21 January 2009 (UTC)
thread_title: Rabin for signatures, and Blum-Williams modification

message: In the example given on the page, mq = 9. By my calculations, mq = 2.
mq2 (congruent to) c mod 11
mq2 (congruent to) 15 mod 11
mq2 = 4
mq = 2
Apologies for poor formatting.
--Newheroicideal 15:07, 25 March 2007 (UTC)
replies: text: In the article square roots are computed using m_q\equiv c^{(q+1)/4}\pmod{q}. Thus m_q\equiv 15^3\equiv 9\pmod{11} is the correct result. But, notice that 2\equiv -9\pmod{11}. Hence 2 is the other square root of c modulo 11, just not the one computed with described method. 85.2.2.33 20:33, 2 April 2007 (UTC)
thread_title:  Worked Example 

message: From c\equiv m^2\pmod{pq} follows that c is a quadratic residue. 
Hence \left({c\over p}\right)=1
Why is this so? Doesn't seem to be correct to me after reading an article on Jacobi symbol... —Ram3ai (talk) 21:25, 17 January 2008 (UTC)
replies: text: If c\equiv m^2\pmod{pq} then c = m^2 + npq for some integer n. So c\equiv m^2\pmod{p}. reetep (talk) 11:27, 18 January 2008 (UTC)
thread_title:  Legendre Symbol 

message: In decryption section a variable 'r' appears "out of the blue", then proabably reused by a possible solution. This proabably comes from different editors not keeping consistency. Even knowing what a Rabin scheme is, it introduces much confusion.  —Preceding unsigned comment added by Janislaw (talk • contribs) 14:48, 14 January 2009 (UTC)
thread_title:  What is 'r' 

message: From the article: 
In our example we get m_p = 1 and m_q = 9.
Since we took p=7, m=20, the first remainder must equal 6 and not 1 (unless any other possible input is considered). Isn't it the case? --Microcell (talk) 19:38, 18 November 2012 (UTC)
thread_title:  1 or 6? 

message: Python (programming language) version 2.x: http://iaktueller.de/rabin.py  — Preceding unsigned comment added by 84.118.82.226 (talk) 21:54, 13 February 2018 (UTC)
thread_title:  The Python script  

message: Assume m^2 is smaller than n, then decryption is trivial. We must just calculate the ordinary square root without modulo, since the \bmod n operation has no effect. 
But we may add a large hash function to the message m so that m^2 is much larger than n. The Clou -
 decryption becomes unique.
=== The density of squares as compared to primes ===
The Prime Number Theorem says that the density of primes smaller or equal n is 1/ln(n). The density of square numbers is 1/n which is much smaller for large numbers.
As consequence a random number  r >= 2^{512}  has only a probability smaller than  \frac{1}{2^{256}}  of being a square number. We can conclude, that the rabin signature is secure for hash function values larger or equal than  2^{512}  provided that integer factorization is hard. 
Hmmmm - yes the signature of a random message can not be forged, since
it very likely that with n larger than   2^{1024}  a random message is much larger than  2^{512} . Ok, so we can add for example a 1024 bit random value to the message and sign this sum instead of the original message. If we include the random value in the signature, it is perfect.
  
 --84.118.82.226 (talk) 17:49, 16 February 2018 (UTC)
thread_title:  As hard as factorization - I don't believe it! 

message: The Prime Number Theorem says that the density of primes smaller or equal n is 1/ln(n). The density of square numbers is 1/n which is much smaller for large numbers.
As consequence a random number  r >= 2^{512}  has only a probability smaller than  \frac{1}{2^{256}}  of being a square number. We can conclude, that the rabin signature is secure for hash function values larger or equal than  2^{512}  provided that integer factorization is hard. 
Hmmmm - yes the signature of a random message can not be forged, since
it very likely that with n larger than   2^{1024}  a random message is much larger than  2^{512} . Ok, so we can add for example a 1024 bit random value to the message and sign this sum instead of the original message. If we include the random value in the signature, it is perfect.
  
 --84.118.82.226 (talk) 17:49, 16 February 2018 (UTC)
thread_title:  The density of squares as compared to primes 

message: The following sentence in the article
>It has the disadvantage that each output of the Rabin function can be generated by any of four possible inputs;
seems unsupported by the Rabin paper - four is the expected number of attempts, but it could be much higher - am I missing something? TD-Linux (talk) 16:36, 19 September 2019 (UTC)
replies: text: Yes I think you're missing something but I'm not sure exactly what the misunderstanding is. The point is that given any number k which is the encryption of a number p1, there are also exactly three other numbers p2, p3 and p4 which also encrypt to k. What part of the Rabin paper do you think contradicts this? Are you by chance looking at section 4 (Inversion is Equivalent to Factorization)? This demonstrates a probabilistic technique for factoring in which the algorithm is repeated an arbitrary number of times until it succeeds, but this is completely unrelated to decryption; it is part of the proof that decryption is as hard as factorization. Someone wishing to decrypt a message wouldn't use the algorithm in section 4, they would use the deterministic algorithm presented in section 2, which produces exactly 4 answers. CodeTalker (talk) 16:57, 19 September 2019 (UTC)
replies: text:  I'm actually looking at the signing section (section 3). I guess that sentence in the intro was referring to the decryption process, not signing process. TD-Linux (talk) 17:29, 19 September 2019 (UTC)
replies: text: Ah I see. Yes, the mention of 4 tries in the signature algorithm is unrelated to the fact that each encrypted message has 4 possible decryptions. This article discusses only encryption and decryption. There should probably be a section mentioning Rabin's signature scheme as well. CodeTalker (talk) 17:56, 19 September 2019 (UTC)
thread_title:  Expected value of 4 vs 4 tries 

message: :The Rabin cryptosystem was the first asymmetric cryptosystem where recovering the plaintext from the ciphertext could be proven to :be as hard as factoring.
See Kunerth%27s_algorithm where a modular square root can be taken without factoring the modulus.  Thus Rabin's assertion that his m^2 mod p*q is equivalent to integer factorisation since Kunerth's method does not need to factor the modulus and can do composite modula Endo999 (talk) 04:22, 6 June 2022 (UTC)
thread_title:  Adolf Kunerth's modular square root algorithm challenges Rabin's assertion that his cryptosystem is as hard as factoring 

message: @49.236.16.238 This revert reintroduced a conceptual error about encryption and signature schemes that the reverted change had fixed.
Creating a signature is not encrypting with a private key, despite pop science or lazy textbook expositions that give this misconception.  Sometimes there are signature schemes and encryption schemes that use a common underlying mathematical primitive, like RSA-FDH and RSA-KEM which can both use cubing modulo a product of large secret primes but are otherwise different in just about every respect.  Other signature schemes, like the hash-based SPHINCS, have no corresponding encryption scheme (in the case of hash-based schemes, they can't: Merkle puzzles are optimal).
Rabin's original paper described a signature scheme, not an encryption scheme; variants of it for encryption came later, generally with security problems rendering them useless for real-world applications and fit only for textbook examples of how not to design encryption schemes.  Secure encryption schemes based on the Rabin trapdoor function (none of which appear in this article, but here's an example secure Rabin-based public-key encryption scheme) take a KEM approach that doesn't feed any plaintexts for encryption into the squaring function at all.  Even the insecure textbook variants often involve padding plaintexts with redundancy, so it's ambiguous what 'encrypting' or 'decrypting' mean here even in context.  For more detail, references, and history about the signature scheme, see the full article on Rabin signatures.
Describing parts of the signature scheme as 'encrypting' numbers is wrong, and saying the actual standard mathematical operation is unambiguous, so I've restored the edits which correctly describe them as squaring or finding square roots.  If you still want the changes reverted, can you please discuss your reasons here? Taylor Riastradh Campbell (talk) 17:56, 7 October 2022 (UTC)
thread_title:  Signature is not encryption with private key