Tag Info

Hot answers tagged

4

The question "why is preimage resistance needed for hash functions" is not really relevant. This is because collision resistance implies preimage resistance. Thus, it is just a fact that if you have collision resistance then you must have preimage resistance. So, instead, I will relate to what preimage resistance is good for at all. In more technical ...


4

DSA relies on $k$ being independent from $d$. You define $k$ as: $k=z^\prime d\mod n$ Substituting $k$ in the signing equation you get: $s = k^{-1} (z+rd) \mod n$ $s z^\prime d = z + rd \mod n$ $d=z (sz^\prime -r)^{-1} \mod n$ The attacker knows everything on the right side and can recover the private key.


2

Not every cryptosystem is provably secure, in fact most aren't. Even among those that are the security is only proved under a limiting set of assumptions, not in a completely general sense. Of those that are provably secure, what's needed is a formal goal, and a proof that the system accomplishes the goal with zero or more formally stated assumptions. For ...


2

What you are describing is called $(t,n)$-threshold signature, where you need at least $t$ parties (out of a total of $n$) to create a signature. Considering your description, it seems that in your case $t=n$, so it is necessary that all the keys are used for creating the signature. This answer assumes that you want to verify the signature with a single ...


2

The tests you can do depend on how much time you want to spend for checking each certificate and the "stupidity" you assume for the given key-owner. You already mentioned the basic checks: Modulus is too small, only interesting if it's smaller than 1024 bits Exponent is unusual, not exactly a vulnerability in most cases The following attacks may take ...


2

The relevant part of Neven et al is this: What this means for practice is that one should not instantiate the hash function with a Merkle-Damgård iteration of an $n$-bit compression function. Instead, one should probably simply truncate the output of a $2n$-bit hash function to $n$ bits. (Such a method would in our situation be reminiscent of Lucks’ ...


2

If Eve can find an $n'$ that is prime (and $n'-1$ is relatively prime to $e$),then she can easily sign any message with that $n', e$ pair. So, the question is: what is the probability that there exists a prime $n'$ such that there is only one bit difference between $n$ and $n'$, and $n' \not\equiv 1 \pmod {e}$ ? The answer is that it is quite good if $e ...


1

There are a lot of other uses for hash functions than signature algorithms. For example, when used as a MAC – whether directly or in HMAC – a preimage attack would recover the key and allow forgery for arbitrary messages. Even specifically in signature algorithms there's the Lamport signature which requires preimage resistance.


1

It always depends on what you mean by secure, but note that, as SAI Peregrinus said in the other answer, not every cryptosystem is provably secure. For example showing that it is easy to produce ciphertext from plaintext but is difficult/impossible to get plain text from ciphertext. The property you describe here is called one-wayness (OW), and it ...



Only top voted, non community-wiki answers of a minimum length are eligible