# Tag Info

Well, if the hash function is weak, then the attacker might be able to take a valid signature for a signed message, and find a second message for which the signature for this first would also validate for the second. For example, if Alice signs the message "I like chocolate", what Bob might do is find a second message "Alice owes Bob $13,106,107.57", and ... 3 Generically speaking you can do this but you shouldn't. It may well be possible to perform specific calculations when a random number is used for both (I'll leave it to the more theoretically inclined to create a demo if this is possible for ElGamal / DSA). Another reason is that the single secret gets known then both keys/algorithms will be compromised. ... 3 According to this answer, RSA with the "usual" "padding scheme, described in PKCS#1 as the 'old-style, v1.5' padding," can be made to satisfy that; one would need to specify NULL or omission and require that the public exponent's prime factors are all easily findable and sufficiently bigger than the 4th root of the modulus. 2 It depends. If the entire input itself is within a DER encoded structure, then I would bug out. There is nothing defined for BER, CER or DER that would allow padding of structures within constructed values. If the input is just followed by additional data or junk bytes then it is up to the protocol or otherwise your discretion if you want to accept the ... 2 I don't think there's an exact "correct" behaviour in this case. It would be up to the implementation to decide, since the spec is only concerned about the DER encoded portion. If your implementation parses the input as it moves along only, and doesn't concern itself with the overall size, then it would work fine. Having said that, I believe the best ... 1 During verification you perform$u^1 = H ( m ) w \mod q$would return the same$u^1$for multple hash values. In general you only want one hash to succeed, even if it is unlikely that an adversary can generate a hash that equals$n q + H(m) w$. Of course this means that any hash with the leftmost bits identical to the org. hash is also acceptable, but at ... 1 What you need to know is that all equations in this context are, implicitly, understood to be modulo n. That information alone should answer all of your questions, starting with the equation k = (z1 - z2) / (s1 - s2) (modulo N), which hence means k = ((z1-z2) * modular_inverse_mod_n(s1-s2)) % n, where I tried to copy your modulus (%) operator. Specifically: ... 1 While no SHA1 collisions have been found, there are some attacks: ~$2^{60}$collision attack. Estimated to cost around \$1-2 million currently in the cloud. Possibly economical soon, especially with specialized hardware. Intractable preimage attacks like $2^{151}$ against reduced round variant, $2^{159}$ against full hash. (Cf. $2^{160}$ brute force on any ...
With my new idea I seem to solve the problem and answer my question, so I'll go ahead and post it as the answer. I choose the new $m'$ as $m'=t+m$ with $t>0$. Now the verification works like this: $v'=g^{m'w} y^{rw}=g^{m'w+xrw}=g^{tw+mw+xrw}=g^{tw} \cdot g^k=r' \mod q$ So my new $r'=g^{tw}r=g^{ts^{-1}}r$ This means I can create a legit signature to any ...