Hot answers tagged certificates
2
To sign a message $M$ under RSA, one should NOT build the signature as $\mathcal{Sign}(M)=M^d\bmod N$, for several reasons:
either that limits to messages $M$ in range $[0..N-1]$, or that allows forgeries of the form $\hat M=M+k\cdot N$, because $\mathcal{Sign}(\hat M)=\mathcal{Sign}(M)$;
that allows forgeries of the form $\hat M=R^e\cdot\prod{M_j}^{a_j}$ ...
Only top voted, non community-wiki answers of a minimum length are eligible
