Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].

learn more… | top users | synonyms

0
votes
1answer
43 views

Why hash function are used in digital signatures? [duplicate]

In the lectures I see, hash functions are always used when we want to sign a document $d$. My question is why they are used in digital signatures? Maybe, because it is more easy and fast to calculate ...
1
vote
0answers
106 views

Password checking algorithm

I'm trying to reverse engineer a key exchange protocol which is based on the Diffie-Hellman key exchange scheme and faced with the following problem: Let $g$ be the generator, $m$ the modulus. Alice ...
2
votes
1answer
496 views

The Boneh-DeMillo-Lipton fault attack (RSA CRT)

I am trying to understand the Boneh-DeMillo-Lipton fault attack on RSA CRT signature. Suppose that we sign a message $m$ with RSA-CRT : $d_p = d \bmod (p-1)$ and $d_q = d \bmod (q-1)$ $s_p = h(m)^{...
1
vote
0answers
49 views

Given a public-key encryption and signature scheme, define a new primitive

I'm new to cryptography and am currently working on the following question: Say you are given a public-key encryption scheme $\Pi_e=(\mathcal{K}_e,\mathcal{E},\mathcal{D})$ and a signature scheme $...
5
votes
1answer
71 views

Can RSA-PSS signing be made deterministic without loss of security?

Is it possible to make RSA-PSS signing deterministic without loss of security? Specifically, I would use Blake2b of the key and message to generate the salt.
0
votes
2answers
44 views

Is ssl_sign safe as it is using OPENSSL_PKCS1_PADDING

I've been hearing a lot of scare talk about PKCS1 padding attacks. Is PKCS1 v1.5 safe in signatures as it is practically transporting only message digest? I'm using it in one of my applications so i'...
1
vote
1answer
66 views

How are all necessary parameters shared between signer and verifier in ED25519 signature scheme?

I want to use ED25519 signature scheme in my application which requires frequent sharing of secret data between two entities in public domain. I know that Schnorr signature scheme has a key ...
1
vote
1answer
55 views

Calculate if a digital signature is valid

In the book An Introduction to Mathematical Cryptography, it mentions a section on digital signatures and a theoretical example. I am having difficulty understanding the book and I was wondering if ...
2
votes
1answer
719 views

How does certificate-based encryption solve key revocation problem?

How does certificate-based encryption solve key revocation problem? For example, if a user accidentally reveals its secret key or an attacker compromises it, the user may request revocation of its ...
3
votes
2answers
3k views

How does a client verify a server certificate?

As far as I know, when I request a certificate from Verisign (for example), and after they approved that me is me, they create a certificate (for me) which contains the digital signature and public ...
4
votes
3answers
5k views

Is javascript RSA signing safe?

I'm currently working on a secure open source messaging system (https://github.com/DSMNET/DSMNET). I'm currently using the cryptico.js (https://github.com/wwwtyro/cryptico) library to encrypt all the ...
3
votes
1answer
90 views

Single public key for NaCL signing and encryption?

Bob wants to use NaCL (specifically the Python NaCL library) to both a) sign some publically available plaintext for anybody to authenticate as being written by Bob and b) encrypt some other secret ...
0
votes
0answers
31 views

Is original DSA a TEGTSS-I scheme?

Brickell et al. define TEGTSS-I scheme in paper "Design validations for discrete logarithm based signature schemes" In this paper original DSA is generalized as DSA-I variant where $r = g^k \bmod p \...
0
votes
2answers
78 views

Detecting Encryption in Real-Time

Is there anyway to detect encryption in real-time through a common signature or pattern recognition. Say, a file is being encrypted using an AES-256 cipher, if I have access to the file stream - can ...
4
votes
0answers
57 views

Authenticated encryption with Enc-Sign-Mac

I've given a CPA secure private key encryption scheme, an unforgeable private key MAC scheme and an unforgeable public key signature scheme. I want to combine them to protect confidentiality, ...
3
votes
1answer
92 views

Authenticated encryption with Signatures

I've given a CPA secure private key encryption scheme (wich gets to a CCA secure scheme or better to an authenticated encryption scheme, when i combine it with a given MAC) and a unforgeable public ...
0
votes
1answer
33 views

Aggregation signature and verification

I'm not even sure of the appropriate terminology to use to describe my problem so bear with me if the explanation is not exactly formal. Imagine I have a simple digital calculator, with a screen and ...
3
votes
1answer
97 views

Combining public key signature schemes and private key encryption

I'm working on my bachelor thesis and I have some questions. I want to combine a CPA-secure private key encryption scheme and some unforgeable public key signature scheme (in my case some sanitizable ...
5
votes
2answers
122 views

Signing MD5 hashes with RSA? [duplicate]

Lets say I need to update a project and allow anyone to distribute the updates, however I need it to be secure, so I hash the data and sign the hash, this project uses MD5. How likely would it be ...
4
votes
1answer
469 views

How is the message digest related to Signatures and Encryption?

I was studying about 'Data Security' and I found out this one thing confusing. What is an message digest? I got it is the hash of the message. Is the message here referring to the plaintext or ...
3
votes
1answer
62 views

Selective and existential unforgability of signature schemes

I understand that one can define EUF-CMA of a signature scheme is terms of a game where the adversary is allowed to query signatures on messages of his choosing, and at the end of the game he must ...
3
votes
1answer
2k views

Demonstrating the insecurity of an RSA signature encoding scheme

I'm working on problem 12.4 from Katz-Lindell. The problem is as follows: Given a public encoding function $\newcommand{\enc}{\operatorname{enc}}\enc$ and a textbook RSA signature scheme where ...
3
votes
1answer
53 views

Is there a standard notation for a message concatenated with its signature?

I'm wondering what's the standard (or canonical) notation for "a message along with its signature", i.e. $$ \mathit{Message}~\Vert~\sigma_k(\mathit{Message}) \text. $$ Here the duplicated $\mathit{...
9
votes
1answer
411 views

Given enough RSA signature values, is it possible to determine the public key value?

Given enough RSA signature values, is it possible to determine which public key is required to verify the values? Could there be enough information to establish which key is required? Is there ...
4
votes
1answer
100 views

How does a company like Apple keep its keys safe? [closed]

Whatever key is used to sign new iOS updates (for example) must be incredibly well-protected. How does a huge corporation like Apple keep those 4096 bits safe?! Same goes for SSL keys for websites ...
3
votes
1answer
92 views

What is the intuition for ECDSA?

I understand DH and ElGamal and RSA encryption/signatures. But when I look at ECDSA (or plain DSA), it seems like the formulas are just pulled out of thin air. I can verify that the algebra used in ...
1
vote
1answer
88 views

Better security than SHA1 for signature?

An application that I maintain uses Sparkle Update to update itself. I expect attacks from high level attackers (China, USA's NSA, etc.) and have some questions about how secure the cryptography ...
1
vote
2answers
55 views

Merkle signature scheme

I was browsing the Wikipedia article on Merkle signature schemes and noted that it says: The number of possible messages must be a power of two[…] Why is that? ...
0
votes
0answers
16 views

Why Sflash signature scheme is constructed in this way?

Sflash is a Multivariate signature scheme that was accepted by NESSIE in 2003, and completely broken in 2007 by a differential attack. Despite I know the total break of Sflash signature scheme and the ...
4
votes
0answers
56 views

How does Boneh–Lynn–Shacham work?

As described by Wikipedia, BLS uses Diffie-Hellman in some way. I understand how Diffie-Hellman works in both its normal and elliptic curve forms. But what is the "pairing function"?
4
votes
1answer
200 views

Is it safe to derive a password from a signature provided by ssh-agent?

I'd like to use a password-based system on a remote host (accessed via SSH) without having to copy-and-paste the password and without storing it on disk. Using the system with some other form of ...
6
votes
2answers
195 views

What is the threat to a PKI when the root CA certificate is generated using SHA1?

We have thousands of servers that have been issued certificates signed by our CA using SHA256 but the our root CAs own certificate was generated using SHA1. Assuming SHA1 is no longer secure for our ...
1
vote
1answer
5k views

Simple digital signature example with number

I've been looking for a simple which signs a number with some randomly generated key and then verified(decrypts the original number) with the public key, which is generated by the private. All the ...
1
vote
1answer
49 views

Universal reencryption for signatures

Universal reencryption is an interesting encryption primitive. Attempts to build signatures schemes or protocols with authentication incorporating it have frequently failed though. A plausible ...
2
votes
1answer
104 views

Shouldn't a signature using ECDSA be exactly 96 bytes, not 102 or 103?

Attempting to use openssl to create a signature is confusing on several levels: If I'm using it to sign a hash that I've already created (HMAC-SHA-384-192, specifically), a. why must I specify ...
1
vote
1answer
70 views

Can Winternitz be easily converted to a many-time encryption scheme?

The Winternitz scheme is typically cited as being an OTS scheme. Can it also be used as a one-time encryption scheme? If it can be used as a one-time encryption scheme, then is it possible to easily ...
4
votes
1answer
68 views

How does the verification process associated with this signature scheme work?

My cryptology professor asked us to show that while the following signature scheme is conceptually valid, that it is inherently insecure, however, I am not sure how to demonstrate that the associated ...
1
vote
2answers
123 views

Shamir's ID based signatures - Notation issues

I am currently implementing Shamir's ID Based signature scheme as defined in the original paper (archive link). The sign and verify operation are defined as follows: Sign: $s = g * r^{f(t,m)} (\mod n)...
3
votes
2answers
374 views

Is authenticated encryption unnecessary if the message is digitally signed?

Normally, it is necessary to use authenticated encryption if the message may be tampered with. Can the authentecation be omitted if the message has been otherwise authenticated?
3
votes
1answer
275 views

Is it possible to perform a rudimentary asymmetric key encryption algorithm by hand?

I have at least three, distinct motivations for having a simple way to use asymmetric key encryption by hand or without modern computers. First, I was recently demonstrating to a 12-year-old how ...
7
votes
3answers
388 views

ECDSA signature verifiable 1-way transformations

Alice signs a message $m$ with her private key, yielding a signature ($r$,$s$). I want to prove to someone else that I have this signature, but I don't want them to have the knowledge of what ($r$,$s$...
4
votes
1answer
440 views

Relation between attack and attack model for signatures

I would like to know: What is the relationship between an attack and an attack model. For example, let $\Pi$ be the Lamport signature scheme. This signature has its security based on any one-way ...
0
votes
1answer
52 views

Breaking the Rabin Signature system with chosen message attack

I heard that we can break the Rabin Signature system using chosen-message attack. I can't find a message to ask for its signature in order to spoof my message M. Any suggestions?
0
votes
1answer
28 views

Vulnerabilities in specifying the hash algorithm used for signature verification on a per-message basis

Let's say that I have a 4096-bit RSA key and when I sign data, I typically use SHA-512. As far as I understand it, the hash algorithm used to sign/verify a message is specified in the message. If a ...
3
votes
1answer
90 views

What is the correct name for bytes which are to be signed?

I have some bytes, and I sign them with my private key using ECDSA. The resultant (71) bytes are the signature. But what is the name of the bytes I have signed? (If this were encryption, they would ...
2
votes
4answers
3k views

Is 512-bit RSA still safe for signature generation?

The standard CSP on Windows XP only supports RSA up to 512-bit, which means that it's the maximum key size I can use for authenticity verification of updates. The public key is embedded in the updater,...
2
votes
1answer
65 views

Proving property of Modified Rabin Signature

I'm trying to prove one of the properties of the “Modified Rabin Signature Scheme”: If $gcd(x, n) = 1$, then $x^{\frac{(p−1)(q−1)}{2}} \equiv 1 \pmod n$ This is what I’ve got so far… Proof Let ...
0
votes
1answer
76 views

Stern identification scheme to signature scheme

I'm trying to understand the comment in the page 103 of the book Postquantum Cryptography. about convert the identification Stern procedure for signing. Can you write an example of signature of this ...
5
votes
1answer
79 views

Choice of the one-way function (OWF) for Lamport signatures

I am studying the Lamport signature scheme, and I found that in many sources (eg: Hash-based Digital Signature Schemes) the input and output bitstring of the OWF and the message digest have the same ...
6
votes
3answers
706 views

What is the advantage of digital signatures over message authentication codes?

Studying for CISSP these choices seemed limited: What is the advantage of digital signatures over message authentication codes? Digital Signature provides integrity verification while ...