# Tag Info

3

First to explain you, why you get 512-bit outputs from a 256-bit curve: The output is basically a point (x-coordinate is enough) and a message-dependant value, with the x-coordinate being expressed as integer. You can verify the signature by checking for a specific relationship between the point and the message-dependant value and the public key point. In ...

2

Signature verification is failed because you are using a different public key in the verification method. Use the public key to verify the signature which is consistent with the private key that is used into rsaSign() method. Hope this will help you. Note that, this public key is consistent with the private key which is used in Signature Generation method : ...

0

We do use the secret key to sign the message as otherwise anybody would be able to sign messages (in your name!) You can hash a message by passing it to cryptographically secure hash function, like SHA-2/3 and interpret the resulting digest as integer $m$. The verification (of plain RSA, please note: RSA is never deployed like this) of RSA-signatures ...

0

The best answer I can come up with is using some sort of Geometric cryptography. It is based on the difficulty of trisecting an angle using a ruler and compass. So you could hand over people a triplet of some secret angle.

-1

See http://TrueTimeStamp.org Free. Easy to manually time stamp files or a file's SHA256 hash. Easy API for automated time-stamping by calling http://truetimestamp.org/submit.php?hash=YOUR_SHA256_IN_HEXADECIMAL_HERE Easy verification of time-stamps on the website by supplying the file or its hash. Supplies Certificates that can be verified even offline. ...

1

Should we sign-then-encrypt, or encrypt-then-sign? ... Do the same issues with (symmetric-key) MAC-then-encrypt apply to (public-key) sign-then-encrypt? Yes. From a security engineering standpoint, you are consuming unauthenticated data during decryption if you mac-then-encrypt or sign-then-encrypt. A very relevant paper is Krawczyk's The Order of ...

1

Can it also be used as a one-time encryption scheme? You cannot build asymmetric encryption from just hash functions. There is an impossibility proof for that. So for asymmetric encryption the answer is no. For symmetric encryption, you can simply use the hash function directly to build encryption, no need to bother with Winternitz. But you could use ...

1

Blinding is usually applied on the whole modulus, and I see no incentive to do otherwise; random is cheap. In RSA, blinding is not always applied as described in the question and article, for efficiency and security reasons: the technique described requires computing $r^d\bmod N$, which is just as costly as the $m^d\bmod N$ operation being protected, and ...

1

Merely receiving a message and seeing that it has a valid signature does not provide any useful information. You also need to know who made the signature, or at least to have some information about them. If you don't know anything about who made the signature, then an adversary can generate their own message using whatever key they like. In your scenario, ...

Top 50 recent answers are included