# Tag Info

6

Is there a RSA scheme which produces fixed size signatures? Normally RSA signatures are fixed size. Depending on encoding and the details included, the length may vary by at least a few bytes, though. There is usually a known maximum at least. The last block can be as small as 1 byte. Is there any cryptographical risk doing this? No. ...

5

Rabin-Williams signature verification with 3072 bit keys is much faster than EdDSA signature verification of comparable security (when done in software). How much depends on care of coding, hardware, EdDSA parameters. Two data points: in the eBATS benchmarks for a skylake CPU, ronald3072 signature verification (RSA with $e=3$ as an OpenSSL wrapper, by ...

1

Suppose you want to obtain the signature $s = m^d \bmod n$ on a chosen message $m$. Here is that attack. You ask the signer to sign a random message $m_1$ and obtain the corresponding signature $s_1 = m_1^d \bmod n$; You compute message $m_2 := m\cdot m_1^{-1} \bmod n$ and ask the signer to sign message $m_2$; you obtain the signature $s_2 = m_2^d \bmod ... 1 The Procedure Step 1: Factor the original signature$s$into$s=\prod_{i=1}^n s_i$and then exponentiate each signature with$e$as in:$m=\prod_{i=1}^n s_i^e=\prod_{i=1}^n m_i$. Different methods to obtain multiple$s_i,m_i\$ pairs work just as well, such as asking the signing oracle. Step 2: Build a new message with a valid signature as the product of any ...

Only top voted, non community-wiki answers of a minimum length are eligible