# Tag Info

2

In general there is no default hash algorithm in the PKCS#1 standards, neither for RSA with PKCS#1 v1.5 padding or RSA with PSS. Both these schemes are defined in RFC 3447 RSA PKCS#1 v2.1. Note that PKCS#1 v2.2 adds a few SHA-2 hash functions (SHA-224 and SHA-512/224 and SHA-512/256) to the mix - neither of which makes much sense. PSS uses a Mask Generation ...

1

Yes, the problem of multicast one-way authentication can be solved using symmetric cryptography only, assuming (at least) one of the following applies (there might be other ways): we trust each receiving party to hold a common secret key secret, and not to use it nefariously; we accept overhead in the broadcasted message growing linearly with the number ...

3

Your problem is not with the signature scheme, something else is wrong. RSA is specified by the RSA cryptography standard, PKCS#1 (mirrored in various RFC's). The PKCS#1 v1.5 padding was introduced in version 1.5 but it persisted in 2.0, 2.1 and 2.2. Those did however introduce a more secure padding scheme called PSS. Unfortunately nobody calls the ...

2

Trivial solution: generate a random $k$ as part of the private key and include $r$ as part of the public key. The verifier uses $r$ from public key, so the signer must use the same $k$ for every valid signature. The signer could create multiple related public keys and reuse $D_A$, but then, they might as well just create multiple key-pairs in the first ...

3

As otus already stated in his comment, the correct term for bytes to be signed is “message”. Generally, it does not really matter if a message to be signed is human readable or not. Sometimes, you may also find it mentioned as “digital message”… which practically is the same and merely extends the term to explicitly hint at the fact the message is digitally ...

2

You are probably aware of the existence of public key certificates. A certificate proves the authenticity of a public key, basically by signing the value of that public key (plus some data on the owner of that key) with a private key of some third party. This third party often is a central Certificate Authority (CA) that is trusted by both the sender and the ...

5

I'd say that most of the time the signature is accompanied by the certificate of the signer. This certificate contains the public key. Most container formats such as CMS (used in S/MIME, also known as PKCS#7) or XML digsig contain specific fields that may contain certificates - and usually do. When the certificate is received the Public Key Infrastructure ...

2

Typically, a message will contain some sort of identifying information of the sender, such as the From header of an e-mail. In any case, if the sender of the message is unknown, what's the point of using signatures at all? The purpose of a signature is to ascertain that the message was written and sent by its purported sender. The only way to be 100% ...

0

As @Myria describes one common RSA signature scheme, defined in the original PKCS#1 as type 1 and retronymed RSASSA-PKCS1-v1_5 in the nearly current version encodes the hash inside the value computed modexp d (and modexp e for recover/verify). Other important RSA schemes like PSS and 9796 do not, and other algorithms like DSA and ECDSA cannot, so systems ...

0

Assuming your signature scheme is non-malleable, it is sufficient to encrypt the message using your private key. The purpose of using digest is to reduce the size of the data to be encrypted. The digest used in such case should be cryptographically secure.

1

There is one such signature scheme designed specifically for cryptocurrencies: https://bitcointalk.org/index.php?topic=1129388.0 It is based on ECDSA and works by committing to $k$ (a number used to create the signature, see https://en.wikipedia.org/wiki/ECDSA) in advance by making $k$ x $G$ part of public key. If this key is used for a second time, $k$ ...

Top 50 recent answers are included