Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].
2
votes
2answers
278 views
Lamport signature: How many signatures are need to forge a signature?
Lamport signature: Signing the message Note that now Alice's private key is used and should never be used again. The other 256 random numbers that she did not use for the signature she must never ...
2
votes
1answer
380 views
Okay to use OpenSSL to encrypt then sign a message?
I am planning on encrypting a message then signing the message so the recipient can authenticate the source. Reading this article has me concerned that I'm doing something wrong.
My current plan is ...
2
votes
2answers
100 views
When to prefer exchanging cryptographic certificates over exchanging only public keys?
Let's think of the following case:
A group of peers want to exchange messages with each other. They use public-key cryptography to sign and encrypt messages. Anyone with any name can join the ...
2
votes
1answer
112 views
Signing a GCM MAC
If I encrypt a message with AES-GCM, is it safe to use the MAC as the hash in a DSA/RSA signature? That is, if someone knows the AES key and nonce, will they be able to generate a different message ...
2
votes
1answer
354 views
Digital Signature Algorithm signature creation
I was studying DSS from "Cryptography and Network Security" by William Stallings. What puzzled me was the DSS approach figure described in the text. It says it uses Public and Private Keys for ...
2
votes
1answer
213 views
Can ElGamal encryption and ElGamal signatures be used together sharing the same key-pairs?
I'm working on a encryption system where each party can store exactly a single ElGamal private key in a device. This is a hardware limit. The system must be expanded to support signatures and ...
2
votes
2answers
148 views
Can I save space for short messages by using encryption with private key instead of a signature?
Let's say I have a message, a Private Key and a Public Key.
Normally if you want to see if the message is unaltered and is from the sender you would have the message part + signature part, which you ...
2
votes
2answers
929 views
FIPS 140-2 Compliant Algorithms
Is there any reference to check the list of encryption & signing algorithms which are compliant to FIPS 140-2. After an exhaustive search I could find only "AES".
Any suggestions would be much ...
2
votes
2answers
126 views
Detect tampering of data
I have the following problem:
There are $n$ users and each users fills in three data points per day, this are three integers between say $-10$ and $10$. I have access to the database and hence I am ...
2
votes
4answers
188 views
Signature and Timestamp for Long Term Document Archival Question
I have a PDF document intended for long-term (many years, maybe decades) archival which I would like to digitally sign with my personal certificate to ensure its integrity.
As far as I understand, I ...
2
votes
2answers
446 views
Proof of security for RSA signatures
I am new to here, I was having some problems with a problem I am working on:
"For each of the following variants of the definition of security for signatures, state whether textbook RSA is secure ...
2
votes
1answer
403 views
Demonstrating the insecurity of an RSA signature encoding scheme
I'm working on problem 12.4 from Katz-Lindell. The problem is as follows:
Given a public encoding function $\newcommand{\enc}{\operatorname{enc}}\enc$ and
a textbook RSA signature scheme where ...
2
votes
1answer
179 views
ElGamal message signatures retrieving the secret value x
If the GCD(r, p-1) is small and the value k is used to sign a message using ElGamal is also small. Then the secret value of x can be determined.
Why is this true? How would one retrieve x?
...
2
votes
1answer
126 views
Chaum undeniable signature - justification for probability of misleading the verifier?
Can anyone explain me in details why does the following statement hold true in Chaum and van Antwerpen scheme for undeniable signature?
The probability that a dishonest signer is able to ...
2
votes
1answer
60 views
Are there any signature schemes that protect against collusion by multiple parties?
Say I want to verify the identity of Alice, but Alice could be colluding with Bob to fool me. Is there any way to verify Alice's identity and also be sure that Bob is not impersonating Alice, e.g. ...
2
votes
1answer
202 views
Are there any practical implementation of a homomorphic hashing or signature scheme?
A homomorphic hash function is a function $H : A \to B$ between two sets with some algebraic structure $(A, *)$ and $(B, \star)$ such that
$H$ is collision resistant, i.e. it is hard to find $x \neq ...
2
votes
0answers
105 views
Ring Signature - paper/code difference in trying to solve inverse trap door function?
there is a paper on ring signatures and a python implementation of it here.
The Step 4 in the paper describes $y_s = v =C_k,_v(y_1, y_2, ... y_r)$ for all $1 \leq i \leq r$ where $i \neq s$. The ...
2
votes
0answers
190 views
How do I encrypt with the private key? [duplicate]
Possible Duplicate:
RSA encryption with private key and decryption with a public key
This wording is creeping everywhere (e.g. there): "I encrypt with the private key" and even sometimes, ...
2
votes
0answers
629 views
An existential forgery attack on ElGamal [closed]
From an old exam question:
Consider this existential forgery attack on ElGamal. Choose $u$, and $v$ such that $\operatorname{gcd}(v, p - 1) = 1$.
Compute $r := y^v g^u \mod p$ and $s := ...
1
vote
3answers
499 views
Is 512-bit RSA still safe for signature generation?
The standard CSP on Windows XP only supports RSA up to 512-bit, which means that it's the maximum key size I can use for authenticity verification of updates. The public key is embedded in the ...
1
vote
5answers
288 views
Approach towards anonymous e-voting
I want to implement an internet-based e-voting system.
Voters shall be able to cast their vote for one out of n possible candidates. Each candidate has his own ballot-box kept by and at a trustworthy ...
1
vote
2answers
594 views
Why DSA cannot be used for encryption?
Here it is mentioned that DSA cannot be used for encrypt. But Both RSA and DSA can be used to generate public and private keys, right? (Or am I wrong?). Then why can't I use the DSA public key to ...
1
vote
3answers
349 views
What is the length of an RSA signature?
Is it the same as the bits of the key (So a 2048 bit system will yield a 2048 bit signature)? At most as the key? Or something else entirely?
1
vote
1answer
122 views
How to collect, process, and transmit data securely?
In my question "Authenticating data generated by a particular build of an open source program", Dave Cary requested that I post a question stating my real problem on a high level rather than the ...
1
vote
1answer
190 views
“Signing” with public key
For this question, the following caveats and assumptions hold:
There exists a 2048-bit RSA key pair used exclusively for signing/verification
The private key is kept completely private
There exists ...
1
vote
1answer
69 views
Is Guillou-Quisquater existentially unforgeable against adaptive message attack under a random oracle model?
First of all, the Guillou-Quisquater digital signature scheme is:
Note everything is $\bmod n$. Message is denoted by $m$.
Private key: $s$
Public key: Hash function $H$, $e$, ...
1
vote
2answers
2k views
Signatures: RSA compared to ECDSA
I'm signing very small messages using RSA, and the signature and public key are added to every message, which requires a lot of space compared to the actual content.
I'm considering switching to ...
1
vote
0answers
85 views
Are hash trees an alternative, quantum-resistant signature scheme which can replace RSA?
Can hash trees can provide quantum resistant signatures to replace RSA for signing securely? What is the key size and how many times can we use same key?
1
vote
0answers
85 views
Determining the algorithm used to generate a digital signature
I have a string "abcd pqrs". This string is digitally signed with an X.509 certificate (with its private key) and it produces a signature.
From the signed string, is it possible to find out what ...
1
vote
0answers
66 views
In S/MIME, are the same certificates always used to sign and encrypt messages?
My assumption is that S/MIME almost always utilizes certificates as follows:
My certificate can be used to allow people to encrypt messages and send them to me.
My certificate (the same ...
1
vote
0answers
143 views
Most frequently used digital signature schemes in the recent years
I am looking to understand if there are any hard figures on which digital signature schemes are most commonly in use today.
I'm only really interested in what is employed recently (ie. last couple ...
0
votes
1answer
127 views
Can we trust digital signatures?
Consider that Alice wants to send a digitally signed message to Bob.
Mallory might be able to publish his public key under Alice's name and then impersonate Alice to send a message with an apparently ...
0
votes
1answer
108 views
RSA/DSA: Wouldn't it make sense to sign using decoding the data hash?
Why is encoding using the private key used for signing? Wouldn't it make sense to keep the premise, that private is for decoding and public is for encoding? i.e. create a hash and threat it as a ...
0
votes
1answer
160 views
Hash collision resistance requirements for Lamport signatures
According to the original paper, Lamport one-time signature scheme uses two one-way functions: $F$ and $G$. The former one, $F$, is used to create a public key by hashing elements of the private key ...
0
votes
1answer
173 views
How does a client verify a server certificate?
As far as I know,
when I request a certificate from Verisign (for example), and after they approved that me is me, they create a certificate (for me) which contains the digital signature and public ...
0
votes
1answer
51 views
Design question for a service that signs messages on behalf of a user
I'm working on a messaging service that lets users author messages and have them signed with an RSA key. The key is used for identity purposes only and can be revoked, so compromising the private key ...
0
votes
1answer
121 views
RSA Signature - Multiple Use Weakness
I cite from Fundamentals of Computer Security (Chapter 7 on Digital Signature, Paragraph 7.3 on RSA Signatures, page 289):
Multiple uses of the RSA Signature scheme tend to weaken it. The way out ...
0
votes
0answers
45 views
Password checking algorithm
I'm trying to reverse engineer key exchange protocol and faced with the following problem:
Protocol is based on Diffie-Hellman key exchange method:
g - generator
m - modulus
Alice:
a - private key
$A ...
0
votes
0answers
30 views
Conditions for proving that a signcryption scheme is secure
If I'm able to prove that any scheme satisfies confidentiality ad unforgeability conditions, will it be a valid signcryption scheme, without explicit signature and encryption parts ?
0
votes
0answers
41 views
ElGamal signature: Forging a signature of a specific form
I have a question I can't solve from one of the courses I'm currently taking:
Show that given a legitimate ElGamal signature $(S,R)$ on a given message $m$, an attacker
can compute a signature ...
0
votes
0answers
37 views
How is sender's public attached and sent to receiver with signed XML? [closed]
In which form the public key of sender is attached with the signed xml document (.Net),inorder to get signature verified at the receiver's end?
0
votes
0answers
47 views
What happens when you use Windows credentials to sign a message?
I'm trying to dig into the messages that are exchanged when you sign a message using Windows credentials. I've modified the default service that is provided when you create a WCF service to use the ...
0
votes
0answers
38 views
hmac sign data or cipher? [duplicate]
Possible Duplicate:
Should we MAC-then-encrypt or encrypt-then-MAC?
Ok, this may be a dumb question but I'm wondering, with an HMAC signature of a ciphertext should I be signing the data ...
-1
votes
1answer
147 views
Why is 2 the inverse of 10?
I have one question about the ECDSA signature scheme.
When Bob wants to send a message to Alice that is to be signed she makes following things (with for example $A = (5,1)$, $d=7$, $q=19$).
...
-1
votes
1answer
92 views
What length should the padding be when encrypting or signing with RSA?
Does it matter what length the padding is? If so - what length should it be?
(Another point: Should it be random?)
-1
votes
1answer
196 views
Implementing Paillier Signature Scheme in Delphi
I've been trying to implement the Paillier Signature Scheme in Delphi, but I can't get it to work and I don't know where the problem is. First of all, I got my info about the scheme from this paper. ...
-1
votes
1answer
130 views
Fiat-Shamir signature
I have a question about Fiat-Shamir signature:
A hash function is h(w)=w mod 2011 and w1=2623, w2=3269, w3=1938.
What is h=? and how to determine k.t bits?
