Tag Info

New answers tagged

0

Although the documents referenced so far are interesting in their own right, the actual relevant (as in "giving a legal value to the signatures") ETSI standard here is ETSI TS 119 312. Note also that the venerable 1999/93/EC Directive on electronic signatures is being replaced by the much more ambitious eIDAS regulation. As a regulation, it applies ...


0

The European Union did not specify an own digital signature standard. More generally, there are several recommendations which algorithms to use for which setting (as already described in other answers and comments). However, so far the EU left it to the US and especially to NIST to run competitions for new algorithm designs and to standardize them (see the ...


0

I would also mention that there are many required properties that you want a authenticated key exchange (AKE) protocol to satisfy, e.g. authentication, key confirmation, forward secrecy, key freshness, secrecy on the session key. What you want is allow Alice and Bob to stablish "session keys" for each session of communication. These session keys are ...


0

Except if you are picky with updates of references, there is such standard. DSA, RSA, ECDSA-$F_p$, ECDSA-$F_{2^n}$, are approved by ETSI TS 102 176-1 V2.1.1 (2011-07) (Electronic Signatures and Infrastructures (ESI); Algorithms and Parameters for Secure Electronic Signatures; Part 1: Hash functions and asymmetric algorithms), which essentially ...


0

Yes, you can perform rudimentary asymmetric encryption or signing by hand, but no it won't be secure. Textbook RSA with small enough numbers is easy to do by hand. Diffie-Hellman to exchange a symmetric key is even easier. However, the kinds of numbers for which this is feasible are far from those needed for real security. There are a lot of other ...


1

Would there be a minimum ciphertext size that is related to the public key size? It depends on the algorithms used. An RSA signature, without any bells and whistles, is equal to the key length in size (i.e. 2048 bits for 2048-bit RSA). Likewise raw RSA encryption adds the same. So if you just use both, you add twice the key length, or 512 bytes for a ...


2

If the adversary gets a signature on $m_1$, then it's true that the adversary could claim the signature is a signature on both $m_1$ and $m_2$, if $h(m_1) = h(m_2)$ (i.e., there is a collision). The adversary does not need the private key to make this claim, anyone holding the public key should be able to verify the signature. The reason the adversary can ...


2

A collision in a hash function $h()$ means that there are two different messages $m_1$ and $m_2$ such that $h(m_1) = d = h(m_2)$. A digital signature of $m_1$ will involve the value $d$, which can be generated by computing $h(m_1)$. But the same value $d$ can also be generated by computing $h(m_2)$. If you are presented with the digital signature value $s ...


0

There exist polynomial time attacks against RSA signatures with constant padding. So, this actually does not exploit the missing check for the padding. It uses index calculus The latest paper that I am aware of in this series is http://www.dtc.umn.edu/~odlyzko/doc/index.calculation.rsa.pdf but you might also be interested in this paper: ...


3

If you are using a secure signature algorithm, padding and all, then it must be secure for messages of any length. So in that sense you are good. However, in many protocols your messages must include something to prevent replay attacks, like an incrementing counter, in which case you shouldn't be signing just a single number if the messages are meant to say ...


2

If you were using $e=3$, then there is a well known attack by Bleichenbacher that enables the trivial generation of a signature that passes verification. This attack was never published, but is described here. Note that this attack appeared in a real vulnerability in Kindle (and some versions of Android). In any case, the attack does not work for $e=65536$. ...


1

The goal of this method is to achieve collision-resilience (resistance against collision attacks). The second hash can be viewed as $H(R || M)$ for message M and some randomness R that is unknown to an attacker. Now, even if an attacker could efficiently find collisions for $H$, he cannot use this ability to run the standard forgery attack that works as ...


0

Is this approach (deriving a password from a signature) cryptographically sound? Not in general. There are signature algorithms that are completely deterministic and signature algorithms that aren't. With the latter kind you would be unable to reproduce the password later. With a deterministic algorithm, yes, the basic idea of using the signature as a ...


3

Peter Schwabe, one of the authors of Ed25519, directed me to a recent paper titled "EdDSA for more curves". The section "Security notes on prehashing", page 5, says that the Ed25519 algorithm without prehashing the message is resistant to collisions in the hash function, while using the algorithm with prehashing is not. Of course the hash function is not ...


2

Signature generation and encryption are two different concepts. The fact that both can use the same one way function does not change that fact. In the case of RSA, both signature generation and encryption (as well as verification and decryption) uses modular exponentiation. These are called the RSA primitives. They have however different inputs: one uses the ...



Top 50 recent answers are included