# Tag Info

3

If you are using a secure signature algorithm, padding and all, then it must be secure for messages of any length. So in that sense you are good. However, in many protocols your messages must include something to prevent replay attacks, like an incrementing counter, in which case you shouldn't be signing just a single number if the messages are meant to say ...

3

Peter Schwabe, one of the authors of Ed25519, directed me to a recent paper titled "EdDSA for more curves". The section "Security notes on prehashing", page 5, says that the Ed25519 algorithm without prehashing the message is resistant to collisions in the hash function, while using the algorithm with prehashing is not. Of course the hash function is not ...

2

Signature generation and encryption are two different concepts. The fact that both can use the same one way function does not change that fact. In the case of RSA, both signature generation and encryption (as well as verification and decryption) uses modular exponentiation. These are called the RSA primitives. They have however different inputs: one uses the ...

2

If you were using $e=3$, then there is a well known attack by Bleichenbacher that enables the trivial generation of a signature that passes verification. This attack was never published, but is described here. Note that this attack appeared in a real vulnerability in Kindle (and some versions of Android). In any case, the attack does not work for $e=65536$. ...

2

If the adversary gets a signature on $m_1$, then it's true that the adversary could claim the signature is a signature on both $m_1$ and $m_2$, if $h(m_1) = h(m_2)$ (i.e., there is a collision). The adversary does not need the private key to make this claim, anyone holding the public key should be able to verify the signature. The reason the adversary can ...

2

A collision in a hash function $h()$ means that there are two different messages $m_1$ and $m_2$ such that $h(m_1) = d = h(m_2)$. A digital signature of $m_1$ will involve the value $d$, which can be generated by computing $h(m_1)$. But the same value $d$ can also be generated by computing $h(m_2)$. If you are presented with the digital signature value $s ... 1 Would there be a minimum ciphertext size that is related to the public key size? It depends on the algorithms used. An RSA signature, without any bells and whistles, is equal to the key length in size (i.e. 2048 bits for 2048-bit RSA). Likewise raw RSA encryption adds the same. So if you just use both, you add twice the key length, or 512 bytes for a ... 1 The goal of this method is to achieve collision-resilience (resistance against collision attacks). The second hash can be viewed as$H(R || M)$for message M and some randomness R that is unknown to an attacker. Now, even if an attacker could efficiently find collisions for$H\$, he cannot use this ability to run the standard forgery attack that works as ...

Only top voted, non community-wiki answers of a minimum length are eligible