Tag Info

New answers tagged

3

According to this answer, RSA with the "usual" "padding scheme, described in PKCS#1 as the 'old-style, v1.5' padding," can be made to satisfy that; one would need to specify NULL or omission and require that the public exponent's prime factors are all easily findable and sufficiently bigger than the 4th root of the modulus.


1

Well, I think it is quite hard to give a really objective and complete answer to this question. Personally, I think that why you may encounter RSA blind signatures quite often is due to it's simplicity. I am not quite sure if you will see it often in practical implementation though, because there has been a patent (which as far as I remember expired quite ...


1

The initial idea of Fiat and Shamir was to eliminate the interaction in public coin protocols (note that public coin means that the random choices of the verifier are made public) and was used to convert three move public coin identification scheme into conceptually simple signature schemes (it has later been proven by Pointcheval and Stern that under the ...


1

First, I think you have a typo in your question since in the original article $s = (M - x y)(r^{-1}) \mod p-1$, and not $s = (M - x^y)(r^{-1}) \mod p-1$. Knowing that, then we can construct $s_2$ from $s, r, M$ and $M_2$: $s_2 = s + (M_2 - M)r^{-1} = (M - x^y)r^{-1} + (M_2 - M)r^{-1} = (M - x^y + M_2 - M)r^{-1} = (M_2 - x y)r^{-1}$ A valid signature for ...


4

Yes! (restrictions apply). ISO/IEC 9796-2 (scheme 1, SHA-1 hash, option 1 also know as implicit hash identifier, alternative signature production function) is a fully standard signature scheme, based on RSA, widely used in the Smart Card industry for public key certificates and message authentication, that adds only 22 bytes of signature overhead (if the ...


1

Schnorr signature is a challenge-response pair $(c, r)$, both from the field defined by order of the group used. Both groups of points on elliptic curves and multiplicative "prime" groups having generators of order 128-bit number are reasonable. This scheme is well-known. Update: given 64 bytes signature size, one would pick a group of order a 256-bit ...


0

Let's assume signature scheme questioned should not provide "cleartext" no-noise message. For Euclidean distance (sum of squares over message components), one would start from a protocol described at ..whether a number is greater than another number without knowing the numbers? One would follow Fiat-Shamir idea for a non-interactive proof, namely produce a ...



Top 50 recent answers are included