Questions tagged [forgery]

Forgery is the process of making, adapting, or imitating objects, statistics, or documents with the intent to deceive. Use this tag on questions revolving around creating a forgery for a specific encryption scheme or for questions about definitions involving unforgeability.

Filter by
Sorted by
Tagged with
61 votes
4 answers
62k views

Why hash the message before signing it with RSA?

The diagram below illustrates the process of digitally signing a message with RSA: As diagram shows, the message is first hashed, and the signature is then computed on the hash, rather than on the ...
evening's user avatar
  • 1,373
6 votes
2 answers
3k views

GMAC vs HMAC in message forgery and bandwidth

Saarinen in his work GCM, GHASH and Weak Keys says that: The GHASH algorithm belongs to a widely studied class of Wegman-Carter polynomial universal hashes. The security bounds known (this and ...
kelalaka's user avatar
  • 48.3k
4 votes
1 answer
1k views

Is this Bleichenbacher '06 style signature forgery possible? (Or more like, why isn't it?)

I assume that most of you know this, but just for the sake of context; Bleichenbacher's signature forgery (https://www.ietf.org/mail-archive/web/openpgp/current/msg00999.html) basically abuses ...
Attila Szasz's user avatar
18 votes
1 answer
2k views

What is the new attack on OCB2 and how does it work?

OCB2 is proposed by Rogaway, Efficient Instantiations of Tweakable Blockciphers and Refinements to Modes OCB and PMAC , and it is standardized in ISO/IEC 19772:2009. The author also provided a proof ...
kelalaka's user avatar
  • 48.3k
14 votes
3 answers
6k views

Lamport signature: How many signatures are needed to forge a signature?

Lamport signature: Signing the message Note that now Alice's private key is used and should never be used again. The other 256 random numbers that she did not use for the signature she must never ...
Sup3rgnu's user avatar
  • 359
14 votes
3 answers
3k views

How difficult is it to practically detect a forgery in a cryptosystem?

If the encryption key that you use doesn't correspond to the decryption key used by the crypto system, it is assumed that it will not be possible to decrypt the message or you'll know that there has ...
Limit's user avatar
  • 417
3 votes
1 answer
856 views

Is ECDSA signature strongly EUF-CMA?

I read, here, that ECDSA signature is EUF-CMA but not SUF-CMA, aka sEUF-CMA (for strong existential unforgeability under adaptively chosen message attacks; see terminology there). Specifically, the ...
fgrieu - mod election time's user avatar
3 votes
1 answer
3k views

RSA signatures without padding?

Suppose I have a message $M$ for which I generate an RSA-2048 digital signature as follows: $H = H(M)$, $H(M)$ being the SHA-256 of the message $M$ $S = H^d \bmod N$ Assume $N = pq$ is properly ...
Filip's user avatar
  • 31
1 vote
1 answer
2k views

Forge CBC-MAC by creating a new message, given the MAC of two messages

The question is quite similar to this one : Forge CBC-MAC given the MAC of two messages and of their concatenation But I still cannot fully understand it, and here's my question: given two messages ...
Hyperventilate's user avatar
15 votes
2 answers
2k views

Attacking RSA signature verification that ignores padding

I am looking at a RSA signature verification that is quite obviously flawed and am wondering if there's a way to exploit that flaw in practice. Signature is generated using RSA with PKCS 1.5 padding, ...
Andrey's user avatar
  • 847
10 votes
1 answer
3k views

Existential unforgeability vs strong unforgeability

In the article https://crypto.stanford.edu/~dabo/pubs/papers/strongsigs.pdf there are two definitions for the security of a digital signature scheme: existential unforgeability and strong ...
Evgeni Vaknin's user avatar
6 votes
2 answers
2k views

RSA Signature Weak Padding Attack

Assume that we have a message $m$ of size $n$, and it is padded with two 01 bytes in front. Then the signature $s$ is computed using a private key $ks$. Can we ...
gregng's user avatar
  • 105
5 votes
1 answer
2k views

Unforgeability and type of adversary

When trying to prove the security of an asymmetric signature, for instance, for existential (or strong) unforgeability against chosen messages attack, do we need to consider the signer as a possible ...
Dingo13's user avatar
  • 2,857
5 votes
1 answer
3k views

Can we trust digital signatures?

Consider that Alice wants to send a digitally signed message to Bob. Mallory might be able to publish his public key under Alice's name and then impersonate Alice to send a message with an apparently ...
kim's user avatar
  • 51
3 votes
3 answers
427 views

What's wrong with this digital signature scheme?

With regards to user authentication... The server sends Alice a randomly chosen number. Alice signs the number and sends the signature back to the server. The server checks the signature using Alice'...
user avatar
3 votes
1 answer
767 views

How bad is it to use the identity function as hash for ECDSA?

I was recently asked whether a certain library supports the ECDSAwithNone Signature algorithm. Clearly this would mean ECDSA with the identity function as the hash function. I know this is a really ...
SEJPM's user avatar
  • 45.9k
2 votes
1 answer
224 views

Universal forgery based on mathematical problem

It is known that DSA admits universal forgery under assumption that the Attacker can solve the equation $x\equiv R^x\pmod p.$ Are there any other protocols admitting universal forgery based on non-...
Alexey Ustinov's user avatar
1 vote
1 answer
383 views

Forgery attack on OCB

When using same nonce in OCB mode of authenticated encryption, how forgery attack can be done?
user2035863's user avatar
1 vote
1 answer
92 views

Ensure deniability of an interactive zero knowledge proof

Suppose that Peggy(prover) and Victor(verifier) are running some zero knowledge proof protocol that does not rely on hidden verifier secrets. The verifier generates randomly chosen challenge values ...
Richard Thiessen's user avatar
1 vote
1 answer
666 views

Forging RSA1024 signature with e=3 where hash is right justified

I am trying to understand (in the frame of exponent 3) how to calculate a "forgery" in the case where the desired result is: xxxxxxxxxxx[...]xxxxxxxxxxxxxxxxxxxxHHHHHHHHHHH[...]HHHHHHHH where HH = a ...
lndshrk's user avatar
  • 13
1 vote
1 answer
2k views

Security of CBC-MAC fixed length with zero padding

I see everywhere that fixed length CBC-MAC should be more or less secure against forgery. But is it really ? Could you forge a message assuming by example that you use CBC-MAC with let's say always ...
user51428's user avatar
  • 121
0 votes
1 answer
1k views

CBC-MAC Forge Attack Question

I am trying to understand how the forgery attack works when using the CBC-MAC Algorithm
CryptoGuru's user avatar