# Tag Info

9

Why is it common practice to create a hash of the message and sign that instead of signing the message directly? Well, the RSA operation can't handle messages longer than the modulus size. That means that if you have a 2048 bit RSA key, you would be unable to directly sign any messages longer than 256 bytes long (and even that would have problems, ...

9

In addition to the performance problems poncho already mentioned when using RSA signatures without hashing I just want to add on the security warning of poncho: Reordering If you have a message $m>N$ with $N$ being the RSA modulus, then you have to perform at least 2 RSA signatures as $m$ does not longer fit into $Z_N$. Let us assume that it requires ...

9

This is standard mathematical notation and not specific to cryptography. The $\Pi$ symbol means Product in much the same sense $\Sigma$ means Sum. For instance, $\Pi_{i=0}^2{u_i^{m_i}} = u_0^{m_0}u_1^{m_1}u_2^{m_2}$

7

Yes. Modern cryptosystems are designed and analysed under the assumption that the key is never used for anything else. If you use your encryption keys for digital signatures, you are violating that assumption, and it is very easy to construct schemes where this violation will compromise security. It is possible to construct schemes that can use the same ...

6

I hope I got your point and try to answer your question. Actually, if I understand you right, then what you call attack can also be seen as an adversary acting in a specific attack model. Therefore I briefly review the security models for digital signature schemes. Goal of an adversary: We start by discussing the goals of an adversary beginning with the ...

6

For many signature schemes, having two signatures using the same randomness for two different hash values allows recovery of the private key. This is used in many security proofs by showing that an adversary that forges a valid signature can be coerced through replaying into producing two signatures of this form. As a consequence, an forger can be twisted ...

6

If you search on "timestamp", "timestamping", and "notary" on Crypto.SE and Security.SE, you'll find lots of references. I've collected a number of timestamping services that were mentioned in one of those places; this should provide a number of companies and online services you can check out: http://www.proofofexistence.com/ https://www.btproof.com/ ...

6

Well, one reason to hash the data before signing it is because RSA can handle only so much data; we might want to sign messages longer than that. For example, suppose we are using a 2k RSA key; that means that the RSA operation can handle messages up to 2047 bits; or 255 bytes. We often want to sign messages longer than 255 bytes. By hashing the message ...

6

No, signing the hash of the public key cannot introduce a weakness on a secure signature scheme. When we have a signature scheme, we assume that it is secure in an chosen text model, where the attacker has access to the public key, and can ask any text of his choosing to be signed. We can see that any such scheme (such as ECCDSA, or so we believe) cannot ...

6

Because the RFC says so. Signing and verifying using this key format is done according to the Digital Signature Standard [FIPS-186-2] using the SHA-1 hash [FIPS-180-2]. It says the same for RSA half a page down. Apparently the signature algorithm is a defined part of the public key method's specification, rather than being negotiated ...

5

Yes, this looks fine. I assume $A$ and $B_i$ are trusted parties. The protocol as I understand it looks like this: $A$, $B_1$,…,$B_n$ agree on a secret key k. $A$ broadcasts messages ($m_1$,MAC($m_1$,$k$)), … , ($m_j$,MAC($m_j$,$k$) which $B_1$,…,$B_n$ receive and authenticate. I assume $A$ and $B_i$ are trusted parties, so no $B_i$ will itself ...

5

Digital signatures are used to solve this type of problem. That is, a way for $A$ to sign the message for $B$ so that $B$ is highly confident that $A$ signed the message in question. There are lots of signature schemes out there, such as RSA signing, DSA, and others. A MAC is not strictly a digital signature, but has a subset of that functionality and may ...

5

I think you don't quite understand how RSA signatures work (and why they are the size they are). When generating an RSA signature, we follow a two-step process: We take that hash of the message we're signing, and convert (and pad) it into an integer $M$ which is between 0 and $N$ (where $N$ is a large integer that specified by the RSA key) We use the RSA ...

5

In a nutshell there are two main uses cases for signing an existing signature: validation: the signature of another person (ex: a superior) is required to give effect to a primary signature. The second signature covers the content, the first signature and potentially additional data added by the second signer. witness / notary: a second person signs only ...

5

Authentication can either mean entity authentication or data authentication. Data authentication is a means to demonstrate that some specific data originates from a specific source and has not been modified during transmission and/or upon storage. It can be achieved by the use of digital signatures in a public key, i.e., asymmetric, setting or message ...

4

In common cryptographic protocols there is only a need to generate RSA asymmetric keys now and then, say once a year. The key pair generation does not have to take place in the same environment either; e.g. you could use openssl command line if that is available. Note that RSA key pair generation time depends on finding large primes; the runtime is not ...

4

Well, lets go through the issues: It seems to be possible to retrieve the (public) key used for creating an ECDSA signature just from the signature alone Nope, not quite. You also need the message being signed. And, with that, it doesn't give you the unique public key; it does allow you to narrow it down to two possibilities (assuming you're using a ...

4

An RSA signature is a sequence of bytes of the same size of the modulus. If the key uses a 1024-bit modulus $n$, then the signature value is, numerically, an integer in the $1..n-1$ range, and the PKCS#1 standard specifies that this integer should be encoded as a sequence of bytes of the same length as would be needed to encode the modulus, i.e. 128 bytes ...

4

Short Answer: NO, it is not safe, do NOT do this. Longer Answer: You are true that you can use your RSA keypair for both operations. This approach is used in many applications and scenarios. There are Web Services or Single Sign-On implementations, which enforce you to use the same key pair for both operations. X.509 certificates do not allow you (by ...

4

No, the signer is per definition in possession of the secret signing key and thus can always produce signatures for any message of his choice. Consequently, a notion of unforgeability is not meaningful with respect to the signer. For a signature scheme one requires unforgeability for parties who are not in possession of the secret signing key but only the ...

4

Yes, there is an attack that has a fair chance of success, like $2^{-8}$ per $Sign$ (and perhaps $Sm$) submitted; or even more depending on exactly how the encryption padding is removed/verified. The attack does not require submitting a message for signature to a party knowing the signature private key. I consider the attacker successful whenever she manages ...

4

No. Cryptography alone cannot solve this problem. Solving this problem requires a combination of technical (e.g., cryptography, systems security) and non-technical (e.g., legal, regulatory, contractual) solutions. Even the technical part is not solely a cryptography question; it as much about systems security.

4

Yes. An independent witness to the signing may vouch for the initial signing, and do so by signing the whole document. E.g. this could indicate that the signing was done by an officer of the company and not a rogue employee.

4

First of all I do not know your implementation, but it seems that you have some basic misunderstandings. Signature: ECDSA(sha256(Data) ) ECDSA is typically implemented in a way that you do not explicitly hash the data prior to passing it to the signing algorithm (but as this might be your own implementation and signing may still work correctly). ...

4

Guillou and Quisquater (link) present a zero-knowledge proof of an RSA signature. Basically, the scheme is as follows: Public knowledge: RSA modulus $n$, public RSA exponent $v$, preimage $X$. Secret knowledge for prover: $A$, such that $A^v = X \mod n$.  \begin{matrix} \mathcal{P} & & \mathcal{V} \\ r \xleftarrow{\$} \mathbb{Z}_n^* ... 4 You can use multi-signatures. One example is the BN06 scheme described in the paper: Bellare, Neven - Multi-signatures in the plain public-Key model and a general forking lemma 3 I'll give a simple example with (textbook) RSA signing. I'm going to assume you understand RSA. First key gen:$p\gets 7,q\gets 13,n\gets pq=91, e\gets 5, d\gets 29$Thus your public key is$(e,n)$and your private key is$d$. Say we want to sign the message$m=35$, we compute$s=m^d\bmod{n}$which is$s\gets 42\equiv 35^{29}\bmod{n}\$. The message and ...

3

Since you asked in general "Are there any other obvious flaws/issues I'm missing", I would recommend that you would take a critical look at the whole update process flow. I would not consider the quality of the PRNG at your server as an obvious weak point, as long as it is reasonably strong, since on servers you have quite a bit of choice of reasonably good ...

3

If you implemented it well, and there is no MITM (i.e. use authenticated comm channel), then it is difficult to forge the RSA signatures (meaning you can use them safely). However, in your implementation there are 2 other major factors that you need to consider: One is the use of Javascript as a coding medium: there are many who consider Javascript to be a ...

3

As very clearly indicated by the specification, CKM_RSA_X_509 performs "raw" RSA. Raw RSA is simply modular exponentiation. So it performs just the RSASP1 function in the PKCS#1 standards. This means that a user should - at the minimum - also provide a secure padding mechanism. Otherwise the conditions to perform a secure RSA signing operation are not met. ...

Only top voted, non community-wiki answers of a minimum length are eligible