Hot answers tagged

6

Any probabilistic signature scheme can be made deterministic without any loss of security. The generic transformation is as follows: Let $(pk,sk)$ be the key-pair of the original signature scheme Choose a random key $k$ for a pseudorandom function $F$ (you can use HMAC or CMAC), where the output of $F$ is enough randomness used to sign. This key is part of ...


4

Ed25519 is well-defined and requires you to use SHA-512 as internal hash function along with the twisted Edwards version of Curve25519, hence there's no need for a KAC when it comes to questions about the parameters. As for the integrity of the public key, there's not yet a standard for Ed25519 based certificates so there would be a custom solution needed ...


2

Is there any possibility to make a successful verification with just modifying message and signature, and without modifying public-key ? One would certainly hope not. If you can, then you've just shown that the signature algorithm used is broken, and not to be trusted. For a signature method to be considered secure, then it is required that someone ...


2

Bruce Schneier writes in Applied Cryptography (2nd ed., p. 38f): In practical implementations, public-key algorithms are often too inefficient to sign long documents. To save time, digital signature protocols are often implemented with one-way hash functions (...). Instead of signing a document, Alice signs the hash of the document. The references ...


2

You're fine. There are several different padding methods listed in PKCS v1.5. The method that has active attacks is actually a padding used during public key encryption - that is, it's used to encode the plaintext message before handing it off to the RSA public function. We don't use that method to sign messages. For that matter, the attack model used ...


2

Basically RSA signatures work just like encryption but with the keys exchanged. If somebody tells you $m^{sk}$ you can easily test if $$ (m^{sk})^{pk} \equiv m\ (mod\ N) $$ but you cannot calculate $m^{sk}$ yourself. The problem/trick is the usual, exponentiation is easy but logarithm is hard. (I like using $sk$/$pk$ for secret-/public-key rather than ...



Only top voted, non community-wiki answers of a minimum length are eligible