Questions tagged [forgery]
Forgery is the process of making, adapting, or imitating objects, statistics, or documents with the intent to deceive. Use this tag on questions revolving around creating a forgery for a specific encryption scheme or for questions about definitions involving unforgeability.
22
questions
61
votes
4
answers
62k
views
Why hash the message before signing it with RSA?
The diagram below illustrates the process of digitally signing a message with RSA:
As diagram shows, the message is first hashed, and the signature is then computed on the hash, rather than on the ...
6
votes
2
answers
3k
views
GMAC vs HMAC in message forgery and bandwidth
Saarinen in his work GCM, GHASH and Weak Keys says that:
The GHASH algorithm belongs to a widely studied class of Wegman-Carter
polynomial universal hashes. The security bounds known (this and ...
4
votes
1
answer
1k
views
Is this Bleichenbacher '06 style signature forgery possible? (Or more like, why isn't it?)
I assume that most of you know this, but just for the sake of context; Bleichenbacher's signature forgery (https://www.ietf.org/mail-archive/web/openpgp/current/msg00999.html) basically abuses ...
18
votes
1
answer
2k
views
What is the new attack on OCB2 and how does it work?
OCB2 is proposed by Rogaway, Efficient Instantiations of Tweakable Blockciphers and Refinements to Modes OCB and PMAC
, and it is standardized in ISO/IEC 19772:2009. The author also provided a proof ...
14
votes
3
answers
6k
views
Lamport signature: How many signatures are needed to forge a signature?
Lamport signature: Signing the message Note that now Alice's private key is used and should never be used again. The other 256 random numbers that she did not use for the signature she must never ...
14
votes
3
answers
3k
views
How difficult is it to practically detect a forgery in a cryptosystem?
If the encryption key that you use doesn't correspond to the decryption key used by the crypto system, it is assumed that it will not be possible to decrypt the message or you'll know that there has ...
3
votes
1
answer
856
views
Is ECDSA signature strongly EUF-CMA?
I read, here, that ECDSA signature is EUF-CMA but not SUF-CMA, aka sEUF-CMA (for strong existential unforgeability under adaptively chosen message attacks; see terminology there).
Specifically, the ...
3
votes
1
answer
3k
views
RSA signatures without padding?
Suppose I have a message $M$ for which I generate an RSA-2048 digital signature as follows:
$H = H(M)$, $H(M)$ being the SHA-256 of the message $M$
$S = H^d \bmod N$
Assume $N = pq$ is properly ...
1
vote
1
answer
2k
views
Forge CBC-MAC by creating a new message, given the MAC of two messages
The question is quite similar to this one : Forge CBC-MAC given the MAC of two messages and of their concatenation
But I still cannot fully understand it, and here's my question:
given two messages ...
15
votes
2
answers
2k
views
Attacking RSA signature verification that ignores padding
I am looking at a RSA signature verification that is quite obviously flawed and am wondering if there's a way to exploit that flaw in practice.
Signature is generated using RSA with PKCS 1.5 padding, ...
10
votes
1
answer
3k
views
Existential unforgeability vs strong unforgeability
In the article https://crypto.stanford.edu/~dabo/pubs/papers/strongsigs.pdf there are two definitions for the security of a digital signature scheme: existential unforgeability and strong ...
6
votes
2
answers
2k
views
RSA Signature Weak Padding Attack
Assume that we have a message $m$ of size $n$, and it is padded with two 01 bytes in front. Then the signature $s$ is computed using a private key $ks$. Can we ...
5
votes
1
answer
2k
views
Unforgeability and type of adversary
When trying to prove the security of an asymmetric signature, for instance, for existential (or strong) unforgeability against chosen messages attack, do we need to consider the signer as a possible ...
5
votes
1
answer
3k
views
Can we trust digital signatures?
Consider that Alice wants to send a digitally signed message to Bob.
Mallory might be able to publish his public key under Alice's name and then impersonate Alice to send a message with an apparently ...
3
votes
3
answers
427
views
What's wrong with this digital signature scheme?
With regards to user authentication...
The server sends Alice a randomly chosen number.
Alice signs the number and sends the signature back to the server.
The server checks the signature using Alice'...
3
votes
1
answer
767
views
How bad is it to use the identity function as hash for ECDSA?
I was recently asked whether a certain library supports the ECDSAwithNone Signature algorithm. Clearly this would mean ECDSA with the identity function as the hash function. I know this is a really ...
2
votes
1
answer
224
views
Universal forgery based on mathematical problem
It is known that DSA admits universal forgery under assumption that the Attacker can solve the equation $x\equiv R^x\pmod p.$ Are there any other protocols admitting universal forgery based on non-...
1
vote
1
answer
383
views
Forgery attack on OCB
When using same nonce in OCB mode of authenticated encryption, how forgery attack can be done?
1
vote
1
answer
92
views
Ensure deniability of an interactive zero knowledge proof
Suppose that Peggy(prover) and Victor(verifier) are running some zero knowledge proof protocol that does not rely on hidden verifier secrets. The verifier generates randomly chosen challenge values ...
1
vote
1
answer
666
views
Forging RSA1024 signature with e=3 where hash is right justified
I am trying to understand (in the frame of exponent 3) how to calculate a "forgery" in the case where the desired result is:
xxxxxxxxxxx[...]xxxxxxxxxxxxxxxxxxxxHHHHHHHHHHH[...]HHHHHHHH
where HH = a ...
1
vote
1
answer
2k
views
Security of CBC-MAC fixed length with zero padding
I see everywhere that fixed length CBC-MAC should be more or less secure against forgery. But is it really ?
Could you forge a message assuming by example that you use CBC-MAC with let's say always ...
0
votes
1
answer
1k
views
CBC-MAC Forge Attack Question
I am trying to understand how the forgery attack works when using the CBC-MAC Algorithm