New answers tagged

6

Is there a RSA scheme which produces fixed size signatures? Normally RSA signatures are fixed size. Depending on encoding and the details included, the length may vary by at least a few bytes, though. There is usually a known maximum at least. The last block can be as small as 1 byte. Is there any cryptographical risk doing this? No. ...


1

The simplest solution is to rely on identity-based signatures. A trusted third party (TTP) defines a set of RSA keys $\mathit{mpk} = \{N,e\}$ and $\mathit{msk} = \{p,q,d\}$ where $N = pq$ for two large primes $p,q$ and $e,d$ such that $e \cdot d \equiv 1 \pmod {(p-1)(q-1)}$. Key $\mathit{mpk}$ is public and is used to check the correctness of signatures; ...


1

Using $x$-coordinates only, given a point $G = (x_0,y_0)$ on an elliptic curve $y^2 = x^3 + ax + b$ and a scalar $r$, the Montgomery ladder outputs the $x$-coordinate of $rG$. However, a closer look at the algorithm shows that the other accumulator used in the computation contains the $x$-coordinate of $(r+1)G$. Letting $x_1$ the $x$-coordinate of $rG$ and ...


2

I am trying to better understand authentication. Lets say I have posted my 128-bit AES symmetric key on some forum, encrypted asymmetrically to my friend using 256-bit ECC (25519). The forum isn't controlled by us so this key message could potentially be tampered with. Well first of all, note that encrypting with curve25519 isn't as trivial as ...


1

If the key is send beforehand it is not required but highly recommended to sign it. Otherwise anybody could post an AES key, encrypted using the public encryption key of your friend. In that case your friend may only find out after receiving the right messages. Furthermore, your friend may not be able to distinguish between an invalid key and an invalid ...


2

The equation $a = x^2 \bmod N$ has at most $4$ solutions $x$. There are solutions if $a$ is a square modulo both $p$ and $q$. This can be checked by computing the Legendre of symbol of $x$ modulo $p$ and modulo $q$. Assuming that the two Legendre symbols are +1, when $p \equiv 3 \pmod 4$, a square-root of $a$ modulo $p$ is given by $x_p = a^{(p+1)/4} ...


3

This is not an answer; rather, I attempt to improve the method outlined in the question. Problem statement (slightly simplified): it is given an RSA public key $(N,e)$ with $2^{n-1}<N<2^n$, $n=2048$, $e=41$, a hash function $H=\operatorname{SHA-1}$ with output of $w=160$ bits. It is asked an $(m,s)$ with $0\le s<N$ and $H(m)=(s^e\bmod N)\bmod2^w$. ...


2

Is there any possibility to make a successful verification with just modifying message and signature, and without modifying public-key ? One would certainly hope not. If you can, then you've just shown that the signature algorithm used is broken, and not to be trusted. For a signature method to be considered secure, then it is required that someone ...



Top 50 recent answers are included