Tag Info

New answers tagged

1

Just read the original paper for ElGamal signatures. Especially one of the attacks in section IV. B should help you out. Alternatively, the Wikipedia article about ElGamals signatures also has a section about existential forgeries. Since this is clearly homework, I'll leave the rest up to you. One last hint: Use q instead of p-1, since you're actually in a ...


0

Before continuing to read this answer, read my above hint: Try writing down all the equations for the different s and try to solve the system of equations. If you still can't solve this one, you may read the remainder of the answer. First observe that $s_1 \equiv k_1 \cdot h(m) + r_1\cdot x \pmod {53}$ and $s_2 \equiv k_2 \cdot h(m') + r_2\cdot x ...


0

Key generation Select prime p and a generator g; Sender S selects a random integer r (secret key) such that 0 < r < p − 1 and calculates K=(g^r)(modp); K, g and p are in public domain; Signing To authenticate message M, the sender selects another random integer R (0 < R < p − 1 and gcd(R,p-1)=1 and computes X=(g^R)(modp); The sender ...


0

Daniel Bleichenbacher has described such kind of attacks in his article Generating ElGamal signatures without knowing the secret key. He noticed that if verifier would accept signatures where $r$ is larger than $p$ then any signature $(r,s)$ on $H(M)$ could be used to generate a signature $(r2, s2)$ on arbitrary hash value $H(M2)$. For that attacker should ...



Top 50 recent answers are included