Tagged Questions
1
vote
1answer
66 views
Is Guillou-Quisquater existentially unforgeable against adaptive message attack under a random oracle model?
First of all, the Guillou-Quisquater digital signature scheme is:
Note everything is $\bmod n$. Message is denoted by $m$.
Private key: $s$
Public key: Hash function $H$, $e$, ...
2
votes
1answer
194 views
Can ElGamal encryption and ElGamal signatures be used together sharing the same key-pairs?
I'm working on a encryption system where each party can store exactly a single ElGamal private key in a device. This is a hardware limit. The system must be expanded to support signatures and ...
4
votes
1answer
441 views
Why is ElGamal considered non-deterministic?
One difference between RSA and ElGamal is that ElGamal isn't necessarily deterministic (while RSA is).
What makes it non-deterministic? Is this advantageous to security? How else does this property ...
2
votes
0answers
588 views
An existential forgery attack on ElGamal [closed]
From an old exam question:
Consider this existential forgery attack on ElGamal. Choose $u$, and $v$ such that $\operatorname{gcd}(v, p - 1) = 1$.
Compute $r := y^v g^u \mod p$ and $s := ...
5
votes
1answer
330 views
How can one show that an ElGamal-like signature verification scheme is valid?
For an ElGamal-like signature scheme, I am given two things:
The signing function,
the verification function.
How can I show that the verification function is valid?
Example 1:
Signing: $s := ...
2
votes
1answer
175 views
ElGamal message signatures retrieving the secret value x
If the GCD(r, p-1) is small and the value k is used to sign a message using ElGamal is also small. Then the secret value of x can be determined.
Why is this true? How would one retrieve x?
...
4
votes
2answers
362 views
ElGamal signature without calculating the inverse
Last time I asked a question of this type on math.se it was redirected here, so I hope this one is also appropriatete for crypto.se.
I stumbled uppon this question in some textbook.
Propose a ...
