Tag Info

Hot answers tagged signature

4

$q$ does not divide $s^e-h(m)$, but $p$ does, so since the gcd must divide both $s^e-h(m)$ and $n$ it's $p$. To be even more explicit, we know that $p$ divides both $s^e-h(m)$ and $n$. The only larger divisor of $n$ that is also divisible by $p$ is $n$ itself, but if $n$ would divide $s^e-h(m)$, then $q$ would also divide $s^e-h(m)$, which we already assumed ...

4

Yes, you can, but you would need access to raw or textbook RSA encryption and you would have to implement the PKCS#1 v1.5 or PSS padding primitives yourself. Beware that PKCS#1 v1.5 compatible padding is different for encryption signature generation. If you only have PKCS#1 v1.5 encryption or OAEP encryption available then the encryption routine will ...

3

The only way you could do this if if you could affect the padding schemes appropriately. Mathematically, textbook RSA encryption with the private key is the same as textbook RSA signature generation. Nobody should use textbook RSA, however. In practice, padding schemes are used and they differ between the two operations. So unless you can turn off padding ...

2

One of the main reasons for hashing is that hashing destroys any algebraic structure that is hidden in the signatures. If you don't hash, then in most signature schemes the messages will satisfy some algebraic relation. A typical example is that $$Sign(m_1m_2)=P(Sign(m_1),Sign(m_2))$$ meaning that the signature of a product/concatenation/whatever of two ...

1

It is extremely likely to be either RSA with PSS padding or RSA with PKCS#1 v1.5 padding, the latter being the most likely. If you sign two times and the output is twice the same then it is not PSS and PKCS#1 v1.5 would be the prime suspect (that was my brain making fun of me, pun not intended). RSASSA-PSS is different from other RSA-based signature ...

1

The text you quoted appears to be incorrect; as specified, it doesn't always work (as you found out). $y_1^m y_2 = g^{\sigma_1} y^{\sigma_2}$ will hold in general if both of the following are true: $$a_1 m + b_1 \equiv \sigma_1 \pmod{p-1}$$ $$a_2 m + b_2 \equiv \sigma_2 \pmod{Order(y)}$$ Note: it is possible for the equation to hold in other conditions, ...

1

Because signing is very expensive and hashing is orders of magnitude faster. If your message was a gigabyte, for instance, it would take many minutes to sign it. With hash-then-sign it is only a few seconds. Also without the hash the signature of a message would be as long as the message itself, which can be inconvenient.

1

Public-key cryptography is not sufficiently computationally burdensome to where other approaches must be used for authentication protocols. Note though that what you describe is not actually public-key based. The verification of the MAC requires Dave and Bob to both have a shared key. Also, note that a random component must be included in some manner in all ...

Only top voted, non community-wiki answers of a minimum length are eligible