# Tag Info

8

In addition to the performance problems poncho already mentioned when using RSA signatures without hashing I just want to add on the security warning of poncho: Reordering If you have a message $m>N$ with $N$ being the RSA modulus, then you have to perform at least 2 RSA signatures as $m$ does not longer fit into $Z_N$. Let us assume that it requires ...

6

Well, one reason to hash the data before signing it is because RSA can handle only so much data; we might want to sign messages longer than that. For example, suppose we are using a 2k RSA key; that means that the RSA operation can handle messages up to 2047 bits; or 255 bytes. We often want to sign messages longer than 255 bytes. By hashing the message ...

6

For the first part of your question: Yes, if Mallory manages to publish is own public key under Alice's name, then there is really nothing to stop him. This problem is addressed with public key infrastuctures and public key certificates. That is, for Bob to believe that the public key is Alice's key, Mallory would need to have a trusted third party attest, ...

4

Each additional signature halves the security level. A security level of about 64 bits can be broken by a determined attacker, and a level of 32 bits can be trivially broken on a single home computer. So if you use 256 pairs, which is a reasonable level, since it offers 256 bit security against second-preimage attacks, and 128 bits against collisions, ...

4

If you don't want to store the anti-CSRF tokens on the server, for most purposes it is sufficient to simply store the token as an HTTP cookie on the client. The OWASP wiki calls this technique "Double Submit Cookies". The reason this works is that, in the standard CSRF attack scenarios, the attacker cannot directly read or modify the user's cookies. ...

3

Look at it this way; consider the value of: $(2^{1019} - N * 2^{34} / 3)^3$ Using the binomial expansion, we see that it equal to: $(2^{1019})^3 - 3 * (2^{1019})^2 * N * 2^{34}/3 + 3 * 2^{1019} * (N * 2^{34} / 3)^2 - (N * 2^{34} / 3)^3$ or (simplifying): $2^{3057} - N * 2^{2072} + G$ where $G = N^2/3 * 2^{1087} - N^3/27 * 2^{102} < 2^{2072}$ for the ...

2

Considering the padding as an addition, padded message passed to sign is $m\cdot 2^{16}+0101$, $0101$ in hexadecimal, assuming padding is done on the lower bytes (for higher bytes the logic is just the same). Being $e$ the private exponent, and $m^2$ computed in the size of $m$, $(m\cdot 2^{16}+0101)^e \pmod m$ is very different from $(m^2\cdot ... 1 I assume that the deadline for the homework is passed, so I will provide an answer: Let us assume that we have the public key$y=g^x \pmod p$and the private key to be$x$. Computing an ElGamal signature for a message$m \in Z_p^*$amounts to: choosing$k\in Z_p^*r\equiv g^k \pmod ps\equiv (m-xk)k^{-1} \pmod{p-1}$which is equivalent to$m\equiv ...

1

What do you mean by forge? If you are asking about (the common) existential forgery, then two message, signature pairs are enough, given that the messages differ in at least two bits. As an example consider that you have the signatures for $m_1 = 1111$ and $m_2 = 1100$. Considering the preimages you now have, you can forge signatures for $m_3=1101$ and ...

Only top voted, non community-wiki answers of a minimum length are eligible