Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].

learn more… | top users | synonyms

0
votes
1answer
130 views

SSL / TLS digital signature exchange

If server is sending its digital signature, in which message / where does the digitally signature is provided to the client. Is it after the server_hello message because there the public key of the ...
2
votes
1answer
124 views

What use is the signature without the message under RSA?

Using RSA for signing & verification, is there a way to take a valid signature for an unknown message, and for someone else to generate a valid signature using a different key against the valid ...
1
vote
0answers
76 views

BER or DER X9.62 ECDSA signature

The signature format for ECDSA signatures can be encoded using ASN.1 integers according to X9.62 or it can comprise of two integers with the same size as the key size. In case the X9.62 format is ...
0
votes
1answer
78 views

Asymmetric sign in public enviroment

I have RTS game, where all players run game and server just relays messages. Game can generate and store text file on player pc. I want to allow some players to be moderators, so I need to sign or ...
5
votes
0answers
93 views

How can ECDSA signatures be shortened (to be used as a product key)?

So I made my own serial key generation software, using ECDSA, for use in my own applications and it works great so far! To keep the serial key short enough I use a 128 bit EC curve. My final signature ...
4
votes
1answer
60 views

Do asymmetric signatures require constant-time verification?

To avoid a timing attack, HMAC signatures are usually compared in constant-time (every byte is compared, and the results aggregated). Is the same necessary for asymmetric signature algorithms such ...
0
votes
1answer
97 views

Why not send the identity in the encrypted message?

I've recently started reading the book "Applied Cryptography" written by Bruce Schneier. Quite a few times I stumbled across protocols who send the identity outside of the encrypted message (see step ...
1
vote
0answers
63 views

Can CKM_RSA_PKCS signature be made secure by lowering its maximum input size?

The CKM_RSA_PKCS Mechanism in PKCS#11 v2.20 section 12.1.6 PKCS #1 v1.5 RSA is a signature scheme commonly used to implement RSASSA-PKCS1-v1_5 of PKCS#1 signature of data hashed externally to a ...
0
votes
0answers
40 views

Signature constructor using Self-signed certificate

I've the following scenario: One application signs JWT access/id tokens using the private key contained in a self-signed certificate, and then passes its public key to other parties to validate that ...
1
vote
1answer
62 views

RSA padding confusion attacks

Server A produces signed messages on request. You can tell server A what type of RSA padding to use in the signature (either RSASSA-PKCS1v1_5 or RSASSA-PSS). Either way, the message will be signed ...
0
votes
1answer
24 views

Reordering of multiple signed blocks

I would like to refer you to page 430 of the Handbook of Applied Crypto, where the authors said "... reordering of multiple signed blocks presents a security risk..." This statement was made in ...
1
vote
1answer
122 views

How do SignRecover and VerifyRecover work?

In PKCS#11, there are the SignRecover and VerifyRecover methods, where the data can be recovered from the signature. How do these methods work? Can I implement signrecover and verifyrecover with ...
16
votes
1answer
14k views

How does RSA signature verification work?

I understand how the RSA algorithm works for encryption and decryption purposes but I don't get how signing is done. Here's what I (think) I know and is common practice: If I have a message that I ...
7
votes
1answer
552 views

understanding forking lemma

Every time when I read a paper that has digital signature, when it comes to prove the security of a digital signature scheme, many chances that the author will use the forking lemma. The forking ...
1
vote
0answers
42 views

Boneh-Boyen like signature scheme

Full Boneh-Boyen signature scheme defines a pair of secret keys (SK) $a \in \mathbb{Z}_n$ and $b \in \mathbb{Z}_n$ and a pair of public keys (PK) $A = G^a \in \mathbb{G}$ and $B = G^b \in \mathbb{G}$. ...
2
votes
2answers
99 views

Is there any advantage on encrypting the CMAC together with the message?

I'm reading a protocol specification where the procedure is to generate a CMAC, take the first 4 bytes of it, append this authentication tag to the message and then encrypt the message + CMAC together ...
0
votes
1answer
70 views

Weak Boneh-Boyen Signature in Composite order group

In the paper Ring Signatures of Sub-linear Size Without Random Oracles, authors have remarked that the scheme is instantiable in composite order setting, too. I am attaching the following reference ...
0
votes
1answer
41 views

Using Permutation polynomial to compute a MAC

Is the following MAC secure? For a block $y_i$ in a file, we defined a MAC as follows: $Mac_i:PRF(k,i) \cdot g^{y_i \cdot r_i} \bmod p$. Where $p$ is a prime number, $g \in \mathbb{G}$,$PRF(k,i)$ is ...
0
votes
1answer
65 views

Non-repudiation and digital signature of a dishonest participant

Let's assume a dishonest Alice who sends, encrypts & digital signs a message to Bob. Bob stores the decrypted message and the digital signature in a database. However Alice is a bad girl and ...
0
votes
0answers
44 views

Is signing a message just encrypting it with private key? [duplicate]

I have a simple question, When I sign a message (in RSA) does the program encrypt the text with my private key? Because I can decrypt it with my public key. Yes or no. Is signing a message just ...
0
votes
0answers
70 views

chameleon signature vs regular signatures

I am trying to understand the practical usage of sanitizable signatures particularly on Chameleon Hashing and Signatures. Chameleon hash, or trapdoor function allow parties with the knowledge of the ...
0
votes
0answers
121 views

Two questions on EMSA-PKCS1-v1_5

If I implement EMSA-PKCS1-v1_5 in the following two non-standard ways, what kind of things could go wrong? The padding structure will be referred as (00|01|PS|00|DER(Digest Algo)|Digest), where | is ...
0
votes
1answer
202 views

Is RSA with SHA1 broken?

I am using CryptSignMessage to sign a string/file. Is using RSASha1 insecure? I know Sha1 is broken as a hashing algorithm, but does that also mean that using it for signing with RSA is broken?
1
vote
1answer
92 views

Why are cryptographically secure hashes required for digital signing (RSA or DSA)?

I know that a cryptographically secure hashing algorithm is required for proper message signing (SHA-1, or I think SHA-2 is the current suggested algorithm). However, why does the hashing algorithm ...
0
votes
0answers
133 views

RSA - Why should we sign hash rather than raw content? [duplicate]

Apart from obvious performance considerations, is there any mathematical or crypto reasons that imply that we sign a hash rather than a raw content ? I read that it was because the hash must fit in ...
1
vote
2answers
109 views

Do I have to transfer the private key to digitally sign a remote document?

I'm trying to digitally sign a document which is uploaded by a user. I want the user to sign that document using his digital signing certificate (DSC). Should I: transfer the file to the user, and ...
1
vote
1answer
109 views

Are there signatures that don't have subliminal channels?

Are there signatures that don't have subliminal channels and also don't require commitments or zero-knowledge proofs? DSA or Shorr signatures need a nonce which can leak valuable information. There ...
2
votes
0answers
62 views

Signature verification with only hash (without full data)

I am looking for a way to sign a file, such that someone else can verify that I had this file, even if they only know a hash. I want to prove that I have the full file to someone who only has the ...
1
vote
1answer
98 views

RSA-blind signatures vs. DSA-blind signatures

I see that the RSA blind signature scheme tends to be implemented more often than others, e.g., DSA blind signatures. Isn't the RSA blind signature scheme a 'lesser' scheme, if you may, compared to ...
1
vote
0answers
139 views

How does Schnorr signature actually work?

I'm trying to get a grip on how Schnorr signature works. Suppose Alice sends Trent a tuple $(P, M)$, which contains a payload and a message to be signed by him. She then passes the certificate to Bob ...
2
votes
1answer
85 views

Explanation of the Fiat-Shamir heuristic

The Wikipedia page on the topic (http://en.wikipedia.org/wiki/Fiat%E2%80%93Shamir_heuristic) is completely useless as it only explains what it is and not how it works. I looked at the original paper ...
0
votes
0answers
84 views

processing time for multiplication and exponentiation in pairing base cryptography

I'm using the Boneh-Boyen-Shacham signature scheme and want to estimate complexity in my scheme. As reported in "Scott M., Efficient Implementation of Cryptographic pairings", if we set parameters ...
3
votes
1answer
298 views

Generating a valid signature on El-Gamal without knowing the private key

Suppose we are given $p$, the large prime, $g$ which is the primitive root for $p$, $b$ which is calculated as $b=g^x$ mod $p$ where $x$ is the private key and $0<x<p-1$. Also suppose we know ...
5
votes
1answer
178 views

Including a “purpose” designation in a digital signature

A signature of some data can mean many different things, such as: This is a message I sent, this is a certificate I validated,... So I was surprised that common signing schemes don't include a ...
7
votes
3answers
1k views

Lamport signature: How many signatures are needed to forge a signature?

Lamport signature: Signing the message Note that now Alice's private key is used and should never be used again. The other 256 random numbers that she did not use for the signature she must never ...
1
vote
0answers
151 views

Existential Forgery on textbook RSA signatures

Can an adversary who haven't seen the message before forge the signature of that message? The adversary has seen $σ_1 = (m_1)^d \bmod N$ and $σ_2 = (m_2)^d \bmod N$ He forges $m' = m_1\cdot m_2$ $σ' ...
5
votes
3answers
700 views

How can one sign with NTRU?

I am looking at implementing NTRU, but I noticed that while the encryption/decryption algorithm seems to be mature and well-documented, there is comparatively little information about how to sign ...
1
vote
2answers
291 views

What does $\Pi$ represent in cryptography?

I am doing a project in cryptography and while reading a tag generation algorithm for files, I got stuck with the meaning of $\Pi$. The screenshot of the algorithm is inserted below. Here the ...
0
votes
1answer
56 views
2
votes
2answers
277 views

Can RSA signing be implemented on top of RSA encryption/decryption?

I need to use RSA-SHA256 signing. Unfortunately not all Microsoft CryptoAPI providers support that. It's possible that I might get a handle to a CryptoAPI provider that can just encrypt/decrypt with ...
0
votes
0answers
48 views

Validity of ElGamal signature variation

I'm trying to solve excersise 7.6 from Hoffstein - Introduction to Mathematical Cryptography page 459 (http://goo.gl/oRyInT) Let $p$ be a prime and let $i$ and $j$ be integers with $gcd(j, p − 1) = ...
3
votes
3answers
1k views

How do public key rings work in cryptographic applications?

I am wondering if there are any links to articles or resources available online, or explanations that you can give, that would help me to understand the concept of a public key ring, and why I might ...
0
votes
4answers
120 views

Why do we need to compute message digest of a message first while signing it?

Why it is more efficient to compute a message digest of message and digitally sign it then, rather than sign the message directly?
5
votes
2answers
414 views

Is RSA encryption of a cryptographic hash with a private key the same as signature generation?

It is often said that RSA encryption with a private key is the same as signing (signature generation). Will RSA encryption with a private key over a cryptographic hash give the same result as ...
2
votes
0answers
71 views

Homomorphic proxy re-signature

Alice has a value $a$ and she signs it using her secret key $d_1$ as: $s_1 = (r_1 * g^a)^{d_1} \bmod p$, and Bob has a value $b$ and he signs it using his secret key $d_2$ as: $s_2 = (r_2 * g^b)^{d_2} ...
0
votes
0answers
27 views

signed message susceptible to block re-ordering , block deletion , block replication

We would implement a Public Key Cryptography (PKC) based digital signature by breaking the message into blocks and signing each block independently. One of the issues associated with digital ...
2
votes
1answer
262 views

The Boneh-DeMillo-Lipton fault attack (RSA CRT)

I am trying to understand the Boneh-DeMillo-Lipton fault attack on RSA CRT signature. Suppose that we sign a message $m$ with RSA-CRT : $d_p = d \bmod (p-1)$ and $d_q = d \bmod (q-1)$ $s_p = ...
0
votes
1answer
64 views

Efficiently show/prove knowledge of third party secret without leaking information

Say Alice publishes (i.e. all parties in the universe) a key or certificate $x$ and sends a secret $s$ to Bob. Bob then publishes some data $d$ (his identity or a message or smt.) and an ...
1
vote
1answer
179 views

Security of chameleon hash functions

With the knowledge of the trapdoor, we are able to compute the same digest for differents messages. I've read that given two messages $m$, $m'$ and two numbers $r$, $r'$ such that ...
0
votes
0answers
186 views

Existential Unforgeability of signature scheme against Adaptive Chosen Message Attack

While reading a literature on signature schemes, I came across the concept of Existential Unforgeability of signature scheme against Adaptive Chosen Message Attack. Can anyone point me to the paper ...