Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].
3
votes
2answers
711 views
How do digital certificates work, and why is it not possible to reverse engineer one from a signed file?
Digital certificates are used quite commonly these days, for signing files. They are used by various operating systems to ensure reliability and security. For example, Android requires that each of ...
2
votes
1answer
353 views
Okay to use OpenSSL to encrypt then sign a message?
I am planning on encrypting a message then signing the message so the recipient can authenticate the source. Reading this article has me concerned that I'm doing something wrong.
My current plan is ...
1
vote
1answer
180 views
“Signing” with public key
For this question, the following caveats and assumptions hold:
There exists a 2048-bit RSA key pair used exclusively for signing/verification
The private key is kept completely private
There exists ...
1
vote
2answers
99 views
When to prefer exchanging cryptographic certificates over exchanging only public keys?
Let's think of the following case:
A group of peers want to exchange messages with each other. They use public-key cryptography to sign and encrypt messages. Anyone with any name can join the ...
3
votes
1answer
124 views
Safely use CryptSignAndEncryptMessage?
I am developing an application that sends messages which I want to encrypt and sign. The CryptoApi offers a function called CryptSignAndEncryptMessage.
The description says, what this function ...
5
votes
1answer
298 views
Why are MACs in general deterministic, whereas digital signature constructions are randomized?
The fact is I'm not quite sure if my question statement is true, however all the MAC constructions I know of (e.g. CBC-MAC, CMAC, HMAC) are deterministic, whereas many constructions for digital ...
2
votes
3answers
225 views
How can one sign with NTRU?
I am looking at implementing NTRU, but I noticed that while the encryption/decryption algorithm seems to be mature and well-documented, there is comparatively little information about how to sign ...
0
votes
1answer
104 views
RSA/DSA: Wouldn't it make sense to sign using decoding the data hash?
Why is encoding using the private key used for signing? Wouldn't it make sense to keep the premise, that private is for decoding and public is for encoding? i.e. create a hash and threat it as a ...
2
votes
2answers
253 views
Lamport signature: How many signatures are need to forge a signature?
Lamport signature: Signing the message Note that now Alice's private key is used and should never be used again. The other 256 random numbers that she did not use for the signature she must never ...
1
vote
2answers
536 views
Why DSA cannot be used for encryption?
Here it is mentioned that DSA cannot be used for encrypt. But Both RSA and DSA can be used to generate public and private keys, right? (Or am I wrong?). Then why can't I use the DSA public key to ...
5
votes
1answer
123 views
Digital signature for an expiring password
I would like to create a publicly available tool that is used to generate a password that gives a limited time access to a resource.
My idea is to digitally sign the current date with a private key ...
5
votes
1answer
155 views
One-way hash on encrypted data, result hidden from hasher
I'm looking for a one-way hash function that can be performed by A on an encrypted piece of data E(D) provided by B, without the performer A able to figure out D or H(D). This similar to HMAC(Message, ...
3
votes
3answers
463 views
Why hash or salt when signing?
I've seen an example of how to sign using RSA. Besides the signing itself (s = m^d mod n) it also hashes and adds an IV.
Why is that needed?
2
votes
1answer
424 views
How to sign a message using RSA?
Assuming I already have a D, P, Q, etc of an RSA key: How do I now sign a message? If it matters – the message is around 100 bits.
I don't know much about cryptography, but I can get these numbers ...
1
vote
0answers
140 views
Most frequently used digital signature schemes in the recent years
I am looking to understand if there are any hard figures on which digital signature schemes are most commonly in use today.
I'm only really interested in what is employed recently (ie. last couple ...
-1
votes
1answer
191 views
Implementing Paillier Signature Scheme in Delphi
I've been trying to implement the Paillier Signature Scheme in Delphi, but I can't get it to work and I don't know where the problem is. First of all, I got my info about the scheme from this paper. ...
2
votes
1answer
59 views
Are there any signature schemes that protect against collusion by multiple parties?
Say I want to verify the identity of Alice, but Alice could be colluding with Bob to fool me. Is there any way to verify Alice's identity and also be sure that Bob is not impersonating Alice, e.g. ...
3
votes
2answers
1k views
Difference between “Signature Algorithm” and “Signature Hash Algorithm” in X.509
What's the difference between the "Signature Algorithm" and the "Signature Hash Algorithm" found in an X.509 certificate? Why does it need a "Signature Hash Algorithm"?
Edit:
I'm creating the ...
4
votes
2answers
200 views
X.509 CSR: Why does CA remove signature?
I just read this article on Wikipedia: Certificate Signing Request
I'm not a PKI or Crypto expert. As I understand, a CSR (certification request) is always signed by the PKCS#10-Request creator.
...
2
votes
2answers
237 views
How do public key rings work in cryptographic applications?
I am wondering if there are any links to articles or resources available online, or explanations that you can give, that would help me to understand the concept of a public key ring, and why I might ...
3
votes
1answer
238 views
What is the computational cost of a public key certificate signature verification?
What is the computational cost of a certificate signature verification in terms of exponentiation, multiplication and other computation operations?
2
votes
1answer
111 views
Signing a GCM MAC
If I encrypt a message with AES-GCM, is it safe to use the MAC as the hash in a DSA/RSA signature? That is, if someone knows the AES key and nonce, will they be able to generate a different message ...
4
votes
1answer
198 views
Threshold Signatures for RSA and DSA
I have a few questions relating to threshold signatures: a scheme where $n$ participants hold a key share and any $t$ of them can conduct a protocol using their shares that results in a valid RSA or ...
0
votes
0answers
38 views
hmac sign data or cipher? [duplicate]
Possible Duplicate:
Should we MAC-then-encrypt or encrypt-then-MAC?
Ok, this may be a dumb question but I'm wondering, with an HMAC signature of a ciphertext should I be signing the data ...
6
votes
3answers
510 views
Can ECDSA signatures be safely made “deterministic”?
Using the terminology of the ECDSA wikipedia page, ECDSA (and DSA) signatures require a random k value for each signature which ensures that the signature is different each time even if the message ...
5
votes
1answer
113 views
Including a “purpose” designation in a digital signature
A signature of some data can mean many different things, such as: This is a message I sent, this is a certificate I validated,... So I was surprised that common signing schemes don't include a ...
2
votes
2answers
409 views
Proof of security for RSA signatures
I am new to here, I was having some problems with a problem I am working on:
"For each of the following variants of the definition of security for signatures, state whether textbook RSA is secure ...
4
votes
1answer
440 views
Why is ElGamal considered non-deterministic?
One difference between RSA and ElGamal is that ElGamal isn't necessarily deterministic (while RSA is).
What makes it non-deterministic? Is this advantageous to security? How else does this property ...
2
votes
1answer
383 views
Demonstrating the insecurity of an RSA signature encoding scheme
I'm working on problem 12.4 from Katz-Lindell. The problem is as follows:
Given a public encoding function $\newcommand{\enc}{\operatorname{enc}}\enc$ and
a textbook RSA signature scheme where ...
2
votes
0answers
583 views
An existential forgery attack on ElGamal [closed]
From an old exam question:
Consider this existential forgery attack on ElGamal. Choose $u$, and $v$ such that $\operatorname{gcd}(v, p - 1) = 1$.
Compute $r := y^v g^u \mod p$ and $s := ...
2
votes
1answer
175 views
ElGamal message signatures retrieving the secret value x
If the GCD(r, p-1) is small and the value k is used to sign a message using ElGamal is also small. Then the secret value of x can be determined.
Why is this true? How would one retrieve x?
...
5
votes
1answer
324 views
How can one show that an ElGamal-like signature verification scheme is valid?
For an ElGamal-like signature scheme, I am given two things:
The signing function,
the verification function.
How can I show that the verification function is valid?
Example 1:
Signing: $s := ...
4
votes
2answers
412 views
Is a RSA-signature of some identifying data a safe way to implement a license key?
I have this idea of implementing a license key:
After the user downloads the program, he connects to a website and sends his Windows product ID.
The website, then, sends this back to him with a ...
5
votes
1answer
674 views
RSA-PSS salt size
One of the inputs of RSA-PSS signing and verification is the salt size. According to PKCS#1, you must know the salt size before the verfication is carried out. However, this makes interoperability ...
3
votes
3answers
421 views
public key cryptography and digital signature
I read the following from Understanding Public Key Cryptography on Microsoft TechNet:
Using a private key to establish identity shows that the full
encryption and decryption operation was ...
4
votes
1answer
142 views
Is there an algorithm or hardware that can sign/verify natural time?
PGP/GPG can used to sign text, others use public key to verify them.
So one could say, that these cryptographic algorithms deal with space.
Are there any algorithms that can deal with time?
E.g. I ...
6
votes
1answer
1k views
How do other, non-RSA algorithms, compare to the PKCS #1 standard?
Arguably the PKCS suite of standards have a profit-oriented bias as they are promoted by RSA and promote their algorithms over others in the form of RFCs and other means.
I'm considering the ...
9
votes
2answers
921 views
What is wrong with using SHA1 in digital signatures? Why is a robust hash function needed?
For the purposes of signing and verifying signatures, what is the value of the hash function?
Why would it matter if SHA1 is later determined to be easy to break? Since a Public/Private key process ...
5
votes
2answers
815 views
Why can't Diffie-Hellman be used for signing?
I understand that signing is often a case of hashing data and then encrypting the hash with the private key. What properties keep Diffie-Hellman from being useful for this?
2
votes
1answer
341 views
Digital Signature Algorithm signature creation
I was studying DSS from "Cryptography and Network Security" by William Stallings. What puzzled me was the DSS approach figure described in the text. It says it uses Public and Private Keys for ...
4
votes
2answers
358 views
ElGamal signature without calculating the inverse
Last time I asked a question of this type on math.se it was redirected here, so I hope this one is also appropriatete for crypto.se.
I stumbled uppon this question in some textbook.
Propose a ...
1
vote
1answer
121 views
How to collect, process, and transmit data securely?
In my question "Authenticating data generated by a particular build of an open source program", Dave Cary requested that I post a question stating my real problem on a high level rather than the ...
3
votes
3answers
128 views
Authenticating data generated by a particular build of an open source program
[I was torn between posting here or security.stackexchange.com. In the end, I felt that this was more of a design question, rather than an implementation question and so chose this forum.]
My ...
8
votes
5answers
264 views
Reduction from signatures to encryption?
Is it possible to construct an (asymmetric) encryption scheme from a signature scheme?
If the signature scheme is deterministic and allows existential forgery (e.g. RSA), then the answer is yes ...
