# Tag Info

0

unforgeability: Given signatures on some messages, hard for the adversary to compute signature on another message Strong unforgeability: Given signatures on some messages, hard for the adversary to compute another signature on any message [EDITED] . (this automatically implies the above). This notion makes sense only when a message has several signatures ...

1

I see no reason to expect $x-1+x^N \bmod N^2$ to be indistinguishable from $r$, at least not based upon the assumption you give. The map $f(x)= x^N \bmod N^2$ is a very different map from the map $g(x) = x-1+x^N \bmod N^2$. The range of $f$ is a subgroup of size $\varphi(N)$; that's not true of $g$ (for instance, the range of $g$ can potentially be the ...

3

No, the signer is per definition in possession of the secret signing key and thus can always produce signatures for any messages of his choice. Consequently, a notion of unforgeability is not meaningful for the signer. You want to achieve unforgeability for parties who are not in possession of the signing key. You may also look at this answer for a more ...

2

One might imagine that the object of a security proof is to know that if someone breaks your system, that means they have (essentially) found a way to do some computation that you couldn't do before. Sort of a consolation prize. However, it is better to consider it as a statement of beliefs and consequences of those beliefs. We believe factoring is hard. If ...

Top 50 recent answers are included