Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].

learn more… | top users | synonyms

0
votes
0answers
34 views

Asymmetric cipher with multiple public keys

Asymmetric cryptography is well known. You generate a private key. Using the private key you generate a public key. Then you can sign a message with the private key and check signatures using the ...
3
votes
2answers
395 views

Why use randomness in digital signature algorithms?

I understand why randomness has to be employed in encryption, because deterministic ciphers are not IND-CPA. I don't understand why digital signature schemes that employ randomness, like RSA-PSS, are ...
0
votes
1answer
79 views

SSL / TLS digital signature exchange

If server is sending its digital signature, in which message / where does the digitally signature is provided to the client. Is it after the server_hello message because there the public key of the ...
1
vote
0answers
36 views

BER or DER X9.62 ECDSA signature

The signature format for ECDSA signatures can be encoded using ASN.1 integers according to X9.62 or it can comprise of two integers with the same size as the key size. In case the X9.62 format is ...
2
votes
1answer
100 views

What use is the signature without the message under RSA?

Using RSA for signing & verification, is there a way to take a valid signature for an unknown message, and for someone else to generate a valid signature using a different key against the valid ...
0
votes
1answer
46 views

anonymous signature implementation and usage?

This is one of the question asked in my class. Implement a anonymous digital signature. So it means hiding signers information. i could not find any article in anonymous digital signing. Also another ...
0
votes
1answer
35 views

PKCS#7 signed data structure in signed PDF document

Is it mandatory to include PKCS#7 data (OID 1.2.840.113549.1.7.1) octet string into the sequence of PKCS#7 signed data? I mean if you want to sign PDF, you are basically adding PKCS#7 container ...
0
votes
0answers
22 views

Device intercommunication with commands

I want to create a smart house project, and in that i bought some simple RF modules. Those modules don't support crypto out of the box but i want to connect them to a device that i would program to ...
0
votes
1answer
69 views

Collision attacks on digital signatures

After reading this document about MD5 collision attacks, I still don't understand how collisions can make digital signatures insecure. In the paper, the researchers created two files with the same ...
5
votes
0answers
72 views

How can ECDSA signatures be shortened (to be used as a product key)?

So I made my own serial key generation software, using ECDSA, for use in my own applications and it works great so far! To keep the serial key short enough I use a 128 bit EC curve. My final signature ...
4
votes
1answer
57 views

Do asymmetric signatures require constant-time verification?

To avoid a timing attack, HMAC signatures are usually compared in constant-time (every byte is compared, and the results aggregated). Is the same necessary for asymmetric signature algorithms such ...
0
votes
1answer
89 views

Why not send the identity in the encrypted message?

I've recently started reading the book "Applied Cryptography" written by Bruce Schneier. Quite a few times I stumbled across protocols who send the identity outside of the encrypted message (see step ...
1
vote
0answers
51 views

Given only RSA public key parameters, what security issues might I be able to detect?

I'm attempting to automate some checks against a large list of .NET assemblies, and want to include a test to see if the RSA parameters used to sign the assemblies are sensible. However, since I don't ...
0
votes
0answers
33 views

Signature constructor using Self-signed certificate

I've the following scenario: One application signs JWT access/id tokens using the private key contained in a self-signed certificate, and then passes its public key to other parties to validate that ...
1
vote
1answer
47 views

RSA padding confusion attacks

Server A produces signed messages on request. You can tell server A what type of RSA padding to use in the signature (either RSASSA-PKCS1v1_5 or RSASSA-PSS). Either way, the message will be signed ...
1
vote
0answers
54 views

Can CKM_RSA_PKCS signature be made secure by lowering its maximum input size?

The CKM_RSA_PKCS Mechanism in PKCS#11 v2.20 section 12.1.6 PKCS #1 v1.5 RSA is a signature scheme commonly used to implement RSASSA-PKCS1-v1_5 of PKCS#1 signature of data hashed externally to a ...
0
votes
1answer
20 views

Reordering of multiple signed blocks

I would like to refer you to page 430 of the Handbook of Applied Crypto, where the authors said "... reordering of multiple signed blocks presents a security risk..." This statement was made in ...
1
vote
1answer
94 views

How do SignRecover and VerifyRecover work?

In PKCS#11, there are the SignRecover and VerifyRecover methods, where the data can be recovered from the signature. How do these methods work? Can I implement signrecover and verifyrecover with ...
1
vote
0answers
34 views

Boneh-Boyen like signature scheme

Full Boneh-Boyen signature scheme defines a pair of secret keys (SK) $a \in \mathbb{Z}_n$ and $b \in \mathbb{Z}_n$ and a pair of public keys (PK) $A = G^a \in \mathbb{G}$ and $B = G^b \in \mathbb{G}$. ...
2
votes
2answers
72 views

Is there any advantage on encrypting the CMAC together with the message?

I'm reading a protocol specification where the procedure is to generate a CMAC, take the first 4 bytes of it, append this authentication tag to the message and then encrypt the message + CMAC together ...
0
votes
1answer
67 views

Weak Boneh-Boyen Signature in Composite order group

In the paper Ring Signatures of Sub-linear Size Without Random Oracles, authors have remarked that the scheme is instantiable in composite order setting, too. I am attaching the following reference ...
0
votes
1answer
36 views

Using Permutation polynomial to compute a MAC

Is the following MAC secure? For a block $y_i$ in a file, we defined a MAC as follows: $Mac_i:PRF(k,i) \cdot g^{y_i \cdot r_i} \bmod p$. Where $p$ is a prime number, $g \in \mathbb{G}$,$PRF(k,i)$ is ...
0
votes
1answer
63 views

Non-repudiation and digital signature of a dishonest participant

Let's assume a dishonest Alice who sends, encrypts & digital signs a message to Bob. Bob stores the decrypted message and the digital signature in a database. However Alice is a bad girl and ...
0
votes
0answers
43 views

Is signing a message just encrypting it with private key? [duplicate]

I have a simple question, When I sign a message (in RSA) does the program encrypt the text with my private key? Because I can decrypt it with my public key. Yes or no. Is signing a message just ...
0
votes
0answers
60 views

chameleon signature vs regular signatures

I am trying to understand the practical usage of sanitizable signatures particularly on Chameleon Hashing and Signatures. Chameleon hash, or trapdoor function allow parties with the knowledge of the ...
0
votes
0answers
110 views

Two questions on EMSA-PKCS1-v1_5

If I implement EMSA-PKCS1-v1_5 in the following two non-standard ways, what kind of things could go wrong? The padding structure will be referred as (00|01|PS|00|DER(Digest Algo)|Digest), where | is ...
0
votes
1answer
92 views

Is RSA with SHA1 broken?

I am using CryptSignMessage to sign a string/file. Is using RSASha1 insecure? I know Sha1 is broken as a hashing algorithm, but does that also mean that using it for signing with RSA is broken?
5
votes
0answers
262 views

Why is EdDSA collision-resilient with SHA-512?

In the Bernstein et al. paper about EdDSA, the authors claim EdDSA is resilient against collisions (i.e. it can still be secure even if the hash function used isn't collision-resistant), drawing on a ...
1
vote
1answer
75 views

Why are cryptographically secure hashes required for digital signing (RSA or DSA)?

I know that a cryptographically secure hashing algorithm is required for proper message signing (SHA-1, or I think SHA-2 is the current suggested algorithm). However, why does the hashing algorithm ...
0
votes
0answers
78 views

RSA - Why should we sign hash rather than raw content? [duplicate]

Apart from obvious performance considerations, is there any mathematical or crypto reasons that imply that we sign a hash rather than a raw content ? I read that it was because the hash must fit in ...
0
votes
1answer
76 views

Asymmetric sign in public enviroment

I have RTS game, where all players run game and server just relays messages. Game can generate and store text file on player pc. I want to allow some players to be moderators, so I need to sign or ...
1
vote
2answers
95 views

Do I have to transfer the private key to digitally sign a remote document?

I'm trying to digitally sign a document which is uploaded by a user. I want the user to sign that document using his digital signing certificate (DSC). Should I: transfer the file to the user, and ...
1
vote
1answer
100 views

Are there signatures that don't have subliminal channels?

Are there signatures that don't have subliminal channels and also don't require commitments or zero-knowledge proofs? DSA or Shorr signatures need a nonce which can leak valuable information. There ...
2
votes
0answers
52 views

Signature verification with only hash (without full data)

I am looking for a way to sign a file, such that someone else can verify that I had this file, even if they only know a hash. I want to prove that I have the full file to someone who only has the ...
1
vote
1answer
73 views

RSA-blind signatures vs. DSA-blind signatures

I see that the RSA blind signature scheme tends to be implemented more often than others, e.g., DSA blind signatures. Isn't the RSA blind signature scheme a 'lesser' scheme, if you may, compared to ...
1
vote
0answers
110 views

How does Schnorr signature actually work?

I'm trying to get a grip on how Schnorr signature works. Suppose Alice sends Trent a tuple $(P, M)$, which contains a payload and a message to be signed by him. She then passes the certificate to Bob ...
0
votes
0answers
74 views

processing time for multiplication and exponentiation in pairing base cryptography

I'm using the Boneh-Boyen-Shacham signature scheme and want to estimate complexity in my scheme. As reported in "Scott M., Efficient Implementation of Cryptographic pairings", if we set parameters ...
0
votes
1answer
58 views

Explanation of the Fiat-Shamir heuristic

The Wikipedia page on the topic (http://en.wikipedia.org/wiki/Fiat%E2%80%93Shamir_heuristic) is completely useless as it only explains what it is and not how it works. I looked at the original paper ...
1
vote
0answers
101 views

Existential Forgery on textbook RSA signatures

Can an adversary who haven't seen the message before forge the signature of that message? The adversary has seen $σ_1 = (m_1)^d \bmod N$ and $σ_2 = (m_2)^d \bmod N$ He forges $m' = m_1\cdot m_2$ $σ' ...
0
votes
1answer
53 views

what does rsaSha512Sign do?

I have the following function: ...
2
votes
2answers
251 views

Can RSA signing be implemented on top of RSA encryption/decryption?

I need to use RSA-SHA256 signing. Unfortunately not all Microsoft CryptoAPI providers support that. It's possible that I might get a handle to a CryptoAPI provider that can just encrypt/decrypt with ...
0
votes
0answers
34 views

Validity of ElGamal signature variation

I'm trying to solve excersise 7.6 from Hoffstein - Introduction to Mathematical Cryptography page 459 (http://goo.gl/oRyInT) Let $p$ be a prime and let $i$ and $j$ be integers with $gcd(j, p − 1) = ...
0
votes
1answer
53 views

Signature scheme doesnt seem to hold

I can't seem to verify this signature scheme. Taking this as an example: $p = 23$, $g = 7$, Private Key : $(12$, $20$, $3$, $18)$, $y = 16$ and $q = 2$ This will give me: $y_1 = 7$12$*16$20 $= ...
0
votes
4answers
95 views

Why do we need to compute message digest of a message first while signing it?

Why it is more efficient to compute a message digest of message and digitally sign it then, rather than sign the message directly?
2
votes
0answers
69 views

Homomorphic proxy re-signature

Alice has a value $a$ and she signs it using her secret key $d_1$ as: $s_1 = (r_1 * g^a)^{d_1} \bmod p$, and Bob has a value $b$ and he signs it using his secret key $d_2$ as: $s_2 = (r_2 * g^b)^{d_2} ...
0
votes
0answers
26 views

signed message susceptible to block re-ordering , block deletion , block replication

We would implement a Public Key Cryptography (PKC) based digital signature by breaking the message into blocks and signing each block independently. One of the issues associated with digital ...
5
votes
3answers
240 views

Are there any digital signature algorithms in common use that result in 32-byte signatures?

I don't consider myself to be an expert in this field, so forgive me if there is an obvious answer. I am having a tough time finding an algorithm that can sign data and output a 32-byte signature, ...
2
votes
1answer
229 views

The Boneh-DeMillo-Lipton fault attack (RSA CRT)

I am trying to understand the Boneh-DeMillo-Lipton fault attack on RSA CRT signature. Suppose that we sign a message $m$ with RSA-CRT : $d_p = d \bmod (p-1)$ and $d_q = d \bmod (q-1)$ $s_p = ...
0
votes
1answer
62 views

Efficiently show/prove knowledge of third party secret without leaking information

Say Alice publishes (i.e. all parties in the universe) a key or certificate $x$ and sends a secret $s$ to Bob. Bob then publishes some data $d$ (his identity or a message or smt.) and an ...
0
votes
1answer
134 views

Security of chameleon hash functions

With the knowledge of the trapdoor, we are able to compute the same digest for differents messages. I've read that given two messages $m$, $m'$ and two numbers $r$, $r'$ such that ...