Tag Info

1

If you use the raw RSA operation ($M^d \bmod n$ or $M^e \bmod n$), then no, it is unsafe to use the same key, because an attacker could trick the private key holder into signing a message $M$ (i.e. generating $M^d$) which is actually an encrypted message ($M = P^e$), thus allowing the attacker to recover the original plaintext ($(P^e)^d = P$). (The dual ...

3

Short Answer: NO, it is not safe, do NOT do this. Longer Answer: You are true that you can use your RSA keypair for both operations. This approach is used in many applications and scenarios. There are Web Services or Single Sign-On implementations, which enforce you to use the same key pair for both operations. X.509 certificates do not allow you (by ...

2

We don't say this can't happen, we just say it won't happen. The only value that will decrypt to $p_2$ under $(e_2,n_2)$ is $p_2^{d_2}$, which we can call $s_2$. So, your problem comes down to asking what is the probability that $s_1=s_2$? If we assume that they're random, and that the moduli are similar enough sizes that this is even a realistic ...

2

I can't remember anyone claiming that: $s_1^{e2} \bmod n_2 = p_2$ is never true. However, there is a single value $s_2 = p_2^{d_2} \bmod n_2$; it would be a rather strange coincidence if that value just happens to be the value $s_1 = p_1^{d_1} \bmod n_1$

1

It is not impossible that a signature be authenticated with respect to the wrong public key. However odds of that are so remote (similar to having a random number less than the public modulus pass as a signature) that we can safely neglect this possibility.

3

Why the CFS signature is affected Let us review the structure of the CFS signature, which is strongly related to the Niederreiter PKE scheme. In the Niederreiter PKE scheme, a public key is $H \in \mathbb{F}^{n \times k}$, which is a scrambled parity-check matrix of the Goppa codes. A plaintext is a decodable error; for example, we set $S = \{\vec{e} \in ... 0 Timestamps allow the recipients to know the order in which messages from an honest party were sent. This is sometimes important in cryptographic protocols. Timestamps sometimes allow the recipient to know that a message from an honest party has been replayed. This is important in cryptographic protocols. These properties sometimes allow protocols using ... 0 Actually, I guess that you are talking about digital signatures and not about public key encryption (since you want to have message authenticity and not confidentiality). Whether using time-stamps or not makes sense depends on your application. Basically, the idea is that the verifier can determine when the signature has been issued and in particular that ... 1 As I already outlined in this answer, hash trees in combination with any one-time signature scheme gives the so called Merkle signature scheme. I assume there is some misunderstanding and therefore I sketch merkle signatures subsequently: The idea is to produce$n$key pairs$(X_i,Y_i)$of a one-time signature scheme and then to take the hash values ... 0 Hash trees alone wont do that. But hash trees in combination with one time signatures (this is called the Merkle signature scheme). If you use hash based one time signatures such as Lamport-Diffie, then yes. Basically, the hash tree is used to "aggregate"$k$public keys by representing the hash values of the public keys as leaves of the hash tree and ... 0 Let us assume that we have the public key$y=g^x \pmod p$and the private key to be$x$. Computing an ElGamal signature for a message$m \in Z_p^*$amounts to: choosing$k\in Z_p^*r\equiv g^k \pmod ps\equiv (m-xk)k^{-1} \pmod{p-1}$which is equivalent to$m\equiv xr+sk \pmod{p-1}$The signature for$m$is the pair$(r,s)$and verifying the ... 1 Yes for example the Merkle tree hash will be able to replace signature based on RSA. Remember that the best quantum algorithm to finding collisions is the Groover algorithm, but that require$2^{n/3}$evaluations of hash function. 2 I still got the impression that you did not really have read my answer to a related question. But still, I try to briefly answer your questions here. First of all, private key extraction essentially means private key generation. Extraction, because the partial private key ($D_A$) is generated with repsect to an identity string$ID_A\$ uniquely identifying ...

1

I'm not quite sure if I understand you correctly. As far as I understand it, you want to produce a threshold signature on the hash value of an X.509 certificate. It is not sure if you require a distribute key generation of the private key, or you are in possession of the signing key and distribute shares of the key to all stakeholders. 1) Actually, in ...

1

This is impossible - the receiver knows nothing about you so there's no way he can assure that the sender is in fact you.

Top 50 recent answers are included