Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].

learn more… | top users | synonyms

-2
votes
0answers
25 views

Signing and hashing a new file detected in a folder

I'd like to sign a file in a folder after detection. I'd also like to save a hash over the file to a text file. Thanks in advance!
2
votes
1answer
81 views

Forgery attack against Textbook RSA with simple redundancy

I know how to forge vanilla Textbook RSA message signatures (easy). I've learnt that by adding a good redundancy to the message, it cannot be forged anymore. How can one add redundancy so that the ...
2
votes
1answer
52 views

Is PKCS7 a signature format or a certificate format?

I always though PKCS7 was a signature format. However, on the net I find several references to PKCS7 being a certificate format - for example, this talks about PKCS7 certificate: Extract raw ...
16
votes
2answers
264 views

Is it possible for Alice and Bob to both sign a message “simultaneously”?

Let's say that there is a message which is considered valid if signed by both Alice and Bob. Alice could sign the message and then give it to Bob, so that he can sign it and give it back to her. But,...
3
votes
1answer
52 views

Need help understanding this exercise's solution

We were given this exercise, which asks us to identify the types of keys used on this diagram: The solution was Kxa -> A's private key Kya -> A's public key KxB -> B's private key My question ...
4
votes
0answers
42 views

How to forge signatures in the Schnorr scheme if $r=g^k$ is eliminated?

I need some help to demonstrate how to forge signatures in the Schnorr scheme if I eliminate the random string $r=g^k$ used in the hash – using $H(M)$ instead of $H(M||r)$. How would one be able to ...
0
votes
1answer
19 views

Digital signature with collision

Let's assume a digital signature scheme such that there's a probability of 0.2 for two random messages to have the same signature. How can I exploit this sheme? I'm having difficulties in finding an ...
3
votes
2answers
68 views

Chosen-Message-Attack RSA-Signature

I know that because of the multplicative property of RSA $s =(s_1s_2) \bmod n = (m_1m_2)^d \bmod n$ If Oscar wants to sign now an own message $m$ he chooses another message $m_1$ with $\gcd(m_1,n)=...
4
votes
1answer
57 views

Is this a good choice of a digital signature scheme?

This is a concrete instantiation of Rabin-Williams signatures. Specifically: The private key is 2 primes $p, q$. The public key is their product $N = pq$ and is approximately 3072 bits long. the ...
4
votes
1answer
429 views

How to sign a large file for random-access reading?

I need to write an "Authoring" application which produces large files. These files must be signed so that the "Consuming" application knows that it was authored with a matching key. The consuming ...
3
votes
0answers
79 views

How to generate an RSASSA-PSS signature with MGF1-SHA256?

As part of rooting a device, I need to generate a 256-byte RSASSA-PSS signature using SHA256 as the hash and MGF1-SHA256 as the mask function, for an update file I created. I can choose any 32-byte ...
1
vote
1answer
48 views

Expire signature

I am looking for a way to have a 'did it expired' key. There's a similar question here, but I have to prevent reusing of the 'did it expired' signature . A possible solution would be a two one-way ...
1
vote
1answer
25 views

Single-scalar multiplication with sign bit

I want to know if there's an "easy" timing-free way to compute the sign of $y$-coordinate of $r G$, for a secret scalar $r$ and $G$ the generator of an elliptic curve. We have several choices for ...
3
votes
2answers
76 views

Does a key need to be signed if it is being used to decrypt a message that is already signed?

I am trying to better understand authentication. Lets say I have posted my 128-bit AES symmetric key on some forum, encrypted asymmetrically to my friend using 256-bit ECC (25519). The forum isn't ...
2
votes
1answer
66 views

Get $a$ such that quadratic residue has a solution (Rabin)

My task is to implement Rabin signature. I have trouble with choosing padding a such that $$x^2 \equiv a \pmod n$$ has a solution. In that context, $n=p\cdot q$ is composite, where $p$ and $q$ are ...
3
votes
1answer
175 views

What is the probability of attacking SHA1 used in RSA signature with small exponent?

There is RSA signature check which has following properties: RSA modulus N which is 2048-bit RSA public exponent equal 41 (0x29) Genuine Signature uses EMSA-PKCS1-v1_5 padding of SHA1 hash, however ...
0
votes
0answers
31 views

check user signed in group signature

I have $N$ users, all of them creating a group digital signature. Also I have user $A$. How can I check if user a signed or not signet in this signature? Is it possible ? Are there other methods how I ...
1
vote
1answer
48 views

Can I get successful signature verification with just altering message and signature?

Assuming I can modify a message and also modify the verification signature, and I also have the public-key but not the private-key. Can I create a message that can be verified with a signature that I ...
0
votes
0answers
31 views

What happens if someone implements tree-base signature scheme incorrectly?

I'm learning about signature schemes and read about Merkele's tree-base signature scheme. There are paragraphs about how the key and signings are generated. Using so-called tree structure and pseudo ...
0
votes
0answers
50 views

signature, hashing schemes

I have 20 friends. we create message(s) (1...i) and tar them up with a file messages.hashes(1..i). We sign these tars with our ...
0
votes
1answer
41 views

Why hash function are used in digital signatures? [duplicate]

In the lectures I see, hash functions are always used when we want to sign a document $d$. My question is why they are used in digital signatures? Maybe, because it is more easy and fast to calculate ...
1
vote
0answers
20 views

How do I prove the tracing part in a ring signature model?

I have a question about the article “efficient and multi-level privacy-preserving communication protocol for VANET” by H. Xiong et al. I need the ID of malicious vehicle, but I could not prove how I ...
1
vote
0answers
49 views

Given a public-key encryption and signature scheme, define a new primitive

I'm new to cryptography and am currently working on the following question: Say you are given a public-key encryption scheme $\Pi_e=(\mathcal{K}_e,\mathcal{E},\mathcal{D})$ and a signature scheme $...
0
votes
2answers
36 views

Is ssl_sign safe as it is using OPENSSL_PKCS1_PADDING

I've been hearing a lot of scare talk about PKCS1 padding attacks. Is PKCS1 v1.5 safe in signatures as it is practically transporting only message digest? I'm using it in one of my applications so i'...
5
votes
1answer
69 views

Can RSA-PSS signing be made deterministic without loss of security?

Is it possible to make RSA-PSS signing deterministic without loss of security? Specifically, I would use Blake2b of the key and message to generate the salt.
1
vote
1answer
54 views

Calculate if a digital signature is valid

In the book An Introduction to Mathematical Cryptography, it mentions a section on digital signatures and a theoretical example. I am having difficulty understanding the book and I was wondering if ...
0
votes
0answers
29 views

Is original DSA a TEGTSS-I scheme?

Brickell et al. define TEGTSS-I scheme in paper "Design validations for discrete logarithm based signature schemes" In this paper original DSA is generalized as DSA-I variant where $r = g^k \bmod p \...
1
vote
1answer
63 views

Why are there $q^2$ keys for each equivalence class in Pedersen-van Heyst Signature Scheme?

How do you know there are $q^2$ keys for each equivalence class in the Pedersen-van Heyst Signature Scheme? My textbook says this is "easy to see", however, I am not seeing it. Is it because in the ...
4
votes
1answer
72 views

Do other one-time signature schemes exist?

I'm curious to know if there are any one-time signature schemes other than Lamport's or its variants (Merkle trees are one such variant). The first I've discovered is called "Bins and Balls" which ...
3
votes
1answer
81 views

Single public key for NaCL signing and encryption?

Bob wants to use NaCL (specifically the Python NaCL library) to both a) sign some publically available plaintext for anybody to authenticate as being written by Bob and b) encrypt some other secret ...
6
votes
0answers
57 views

Explanation and proof of a well-know probabilistic lemma

Pointcheval and Stern in their paper on "Security proofs for Signature Schemes" state the following "well-known" probabilistic lemma: Let $A \subset X \times Y$, such that $\mathrm{Pr}[A(x, y)] \...
0
votes
2answers
73 views

Detecting Encryption in Real-Time

Is there anyway to detect encryption in real-time through a common signature or pattern recognition. Say, a file is being encrypted using an AES-256 cipher, if I have access to the file stream - can ...
4
votes
0answers
54 views

Authenticated encryption with Enc-Sign-Mac

I've given a CPA secure private key encryption scheme, an unforgeable private key MAC scheme and an unforgeable public key signature scheme. I want to combine them to protect confidentiality, ...
0
votes
1answer
32 views

Aggregation signature and verification

I'm not even sure of the appropriate terminology to use to describe my problem so bear with me if the explanation is not exactly formal. Imagine I have a simple digital calculator, with a screen and ...
3
votes
1answer
89 views

Authenticated encryption with Signatures

I've given a CPA secure private key encryption scheme (wich gets to a CCA secure scheme or better to an authenticated encryption scheme, when i combine it with a given MAC) and a unforgeable public ...
3
votes
1answer
88 views

Combining public key signature schemes and private key encryption

I'm working on my bachelor thesis and I have some questions. I want to combine a CPA-secure private key encryption scheme and some unforgeable public key signature scheme (in my case some sanitizable ...
4
votes
1answer
465 views

How is the message digest related to Signatures and Encryption?

I was studying about 'Data Security' and I found out this one thing confusing. What is an message digest? I got it is the hash of the message. Is the message here referring to the plaintext or ...
5
votes
2answers
114 views

Signing MD5 hashes with RSA? [duplicate]

Lets say I need to update a project and allow anyone to distribute the updates, however I need it to be secure, so I hash the data and sign the hash, this project uses MD5. How likely would it be ...
3
votes
1answer
55 views

Selective and existential unforgability of signature schemes

I understand that one can define EUF-CMA of a signature scheme is terms of a game where the adversary is allowed to query signatures on messages of his choosing, and at the end of the game he must ...
9
votes
1answer
409 views

Given enough RSA signature values, is it possible to determine the public key value?

Given enough RSA signature values, is it possible to determine which public key is required to verify the values? Could there be enough information to establish which key is required? Is there ...
4
votes
1answer
92 views

How does a company like Apple keep its keys safe? [closed]

Whatever key is used to sign new iOS updates (for example) must be incredibly well-protected. How does a huge corporation like Apple keep those 4096 bits safe?! Same goes for SSL keys for websites ...
3
votes
1answer
91 views

What is the intuition for ECDSA?

I understand DH and ElGamal and RSA encryption/signatures. But when I look at ECDSA (or plain DSA), it seems like the formulas are just pulled out of thin air. I can verify that the algebra used in ...
1
vote
1answer
82 views

Better security than SHA1 for signature?

An application that I maintain uses Sparkle Update to update itself. I expect attacks from high level attackers (China, USA's NSA, etc.) and have some questions about how secure the cryptography ...
1
vote
2answers
52 views

Merkle signature scheme

I was browsing the Wikipedia article on Merkle signature schemes and noted that it says: The number of possible messages must be a power of two[…] Why is that? ...
0
votes
0answers
15 views

Why Sflash signature scheme is constructed in this way?

Sflash is a Multivariate signature scheme that was accepted by NESSIE in 2003, and completely broken in 2007 by a differential attack. Despite I know the total break of Sflash signature scheme and the ...
4
votes
0answers
52 views

How does Boneh–Lynn–Shacham work?

As described by Wikipedia, BLS uses Diffie-Hellman in some way. I understand how Diffie-Hellman works in both its normal and elliptic curve forms. But what is the "pairing function"?
6
votes
2answers
187 views

What is the threat to a PKI when the root CA certificate is generated using SHA1?

We have thousands of servers that have been issued certificates signed by our CA using SHA256 but the our root CAs own certificate was generated using SHA1. Assuming SHA1 is no longer secure for our ...
1
vote
1answer
76 views

Shouldn't a signature using ECDSA be exactly 96 bytes, not 102 or 103?

Attempting to use openssl to create a signature is confusing on several levels: If I'm using it to sign a hash that I've already created (HMAC-SHA-384-192, specifically), a. why must I specify ...
1
vote
1answer
49 views

Universal reencryption for signatures

Universal reencryption is an interesting encryption primitive. Attempts to build signatures schemes or protocols with authentication incorporating it have frequently failed though. A plausible ...
4
votes
1answer
67 views

How does the verification process associated with this signature scheme work?

My cryptology professor asked us to show that while the following signature scheme is conceptually valid, that it is inherently insecure, however, I am not sure how to demonstrate that the associated ...