# Tag Info

3

Short Answer: NO, it is not safe, do NOT do this. Longer Answer: You are true that you can use your RSA keypair for both operations. This approach is used in many applications and scenarios. There are Web Services or Single Sign-On implementations, which enforce you to use the same key pair for both operations. X.509 certificates do not allow you (by ...

3

Why the CFS signature is affected Let us review the structure of the CFS signature, which is strongly related to the Niederreiter PKE scheme. In the Niederreiter PKE scheme, a public key is $H \in \mathbb{F}^{n \times k}$, which is a scrambled parity-check matrix of the Goppa codes. A plaintext is a decodable error; for example, we set $S = \{\vec{e} \in ... 2 I still got the impression that you did not really have read my answer to a related question. But still, I try to briefly answer your questions here. First of all, private key extraction essentially means private key generation. Extraction, because the partial private key ($D_A$) is generated with repsect to an identity string$ID_A$uniquely identifying ... 2 We don't say this can't happen, we just say it won't happen. The only value that will decrypt to$p_2$under$(e_2,n_2)$is$p_2^{d_2}$, which we can call$s_2$. So, your problem comes down to asking what is the probability that$s_1=s_2$? If we assume that they're random, and that the moduli are similar enough sizes that this is even a realistic ... 1 If you use the raw RSA operation ($M^d \bmod n$or$M^e \bmod n$), then no, it is unsafe to use the same key, because an attacker could trick the private key holder into signing a message$M$(i.e. generating$M^d$) which is actually an encrypted message ($M = P^e$), thus allowing the attacker to recover the original plaintext ($(P^e)^d = P$). (The dual ... 1 As I already outlined in this answer, hash trees in combination with any one-time signature scheme gives the so called Merkle signature scheme. I assume there is some misunderstanding and therefore I sketch merkle signatures subsequently: The idea is to produce$n$key pairs$(X_i,Y_i)\$ of a one-time signature scheme and then to take the hash values ...

1

I'm not quite sure if I understand you correctly. As far as I understand it, you want to produce a threshold signature on the hash value of an X.509 certificate. It is not sure if you require a distribute key generation of the private key, or you are in possession of the signing key and distribute shares of the key to all stakeholders. 1) Actually, in ...

Only top voted, non community-wiki answers of a minimum length are eligible