# Tag Info

## Hot answers tagged signature

4

The question "why is preimage resistance needed for hash functions" is not really relevant. This is because collision resistance implies preimage resistance. Thus, it is just a fact that if you have collision resistance then you must have preimage resistance. So, instead, I will relate to what preimage resistance is good for at all. In more technical ...

4

DSA relies on $k$ being independent from $d$. You define $k$ as: $k=z^\prime d\mod n$ Substituting $k$ in the signing equation you get: $s = k^{-1} (z+rd) \mod n$ $s z^\prime d = z + rd \mod n$ $d=z (sz^\prime -r)^{-1} \mod n$ The attacker knows everything on the right side and can recover the private key.

2

Not every cryptosystem is provably secure, in fact most aren't. Even among those that are the security is only proved under a limiting set of assumptions, not in a completely general sense. Of those that are provably secure, what's needed is a formal goal, and a proof that the system accomplishes the goal with zero or more formally stated assumptions. For ...

2

What you are describing is called $(t,n)$-threshold signature, where you need at least $t$ parties (out of a total of $n$) to create a signature. Considering your description, it seems that in your case $t=n$, so it is necessary that all the keys are used for creating the signature. This answer assumes that you want to verify the signature with a single ...

2

The tests you can do depend on how much time you want to spend for checking each certificate and the "stupidity" you assume for the given key-owner. You already mentioned the basic checks: Modulus is too small, only interesting if it's smaller than 1024 bits Exponent is unusual, not exactly a vulnerability in most cases The following attacks may take ...

2

The relevant part of Neven et al is this: What this means for practice is that one should not instantiate the hash function with a Merkle-Damgård iteration of an $n$-bit compression function. Instead, one should probably simply truncate the output of a $2n$-bit hash function to $n$ bits. (Such a method would in our situation be reminiscent of Lucks’ ...

2

If Eve can find an $n'$ that is prime (and $n'-1$ is relatively prime to $e$),then she can easily sign any message with that $n', e$ pair. So, the question is: what is the probability that there exists a prime $n'$ such that there is only one bit difference between $n$ and $n'$, and $n' \not\equiv 1 \pmod {e}$ ? The answer is that it is quite good if \$e ...

1

There are a lot of other uses for hash functions than signature algorithms. For example, when used as a MAC – whether directly or in HMAC – a preimage attack would recover the key and allow forgery for arbitrary messages. Even specifically in signature algorithms there's the Lamport signature which requires preimage resistance.

1

It always depends on what you mean by secure, but note that, as SAI Peregrinus said in the other answer, not every cryptosystem is provably secure. For example showing that it is easy to produce ciphertext from plaintext but is difficult/impossible to get plain text from ciphertext. The property you describe here is called one-wayness (OW), and it ...

1

If by authenticated encryption we mean encrypt-then-MAC then that provides some mitigation against side channel attacks - timing, error responses etc - because it allows you to detect that the message has been tampered before you start decrypting it and in something hopefully close to constant time. It is perhaps worth mentioning that in TLS the opposite ...

1

I suggest that you look at Signcryption; a short survey appears here, and efficient schemes appear here. Just signing then encrypting or vice versa in a naive way is not secure (especially in the multi-user setting). So you have to do this right. Once you have a concrete scheme, you then have to see what level of security the encryption scheme needs to be. ...

Only top voted, non community-wiki answers of a minimum length are eligible