Reputation
Top tag
Next privilege 125 Rep.
Vote down
Badges
5
Newest
 Scholar
Impact
~147 people reached

  • 0 posts edited
  • 0 helpful flags
  • 2 votes cast
Apr
22
awarded  Scholar
Apr
22
accepted Stripping off message authentication or signature
Apr
20
awarded  Commentator
Apr
20
comment Stripping off message authentication or signature
would it correct to assert the above that it is largely a transitive key-binding trust issue?
Apr
17
awarded  Supporter
Apr
17
comment Stripping off message authentication or signature
If they had used RSA-OAEP or AES-GCM, it would be mitigated since it depends on the key in the RSA scheme that guards the cipher key which attackers cannot access. If the signature is encrypted, the key has to be trusted, and binded. It can't be simply detached and attached for IND-CCA2.
Apr
17
comment Stripping off message authentication or signature
I think I got it. The key point is with key management. It was assumed that the key that signed had been trusted. While in AES-CTR, the key is binded by the 1st RSA, and if it is GCM, it is binded by the same. The weakness occurs with the the signing key. They made it too complex using 3 algorithms to pieced to form 1 scheme. As the signing key is on a separate system, and possibly compromised, that key can untrusted. Because the signing is untrusted and unbinded, it becomes the weak link. When it is compromised or becomes a rogue key, it becomes a spy key.
Apr
16
comment Stripping off message authentication or signature
I understand that. However, the signature has a key too which the recipient can expect, and should also return unauthenticated. Why can't that suffice? As well, when AES-GCM returns "decryption failed", it can also be abused as an oracle. Thank you for your patience, I am trying to understand this.
Apr
16
comment Stripping off message authentication or signature
The authentication tag is just part of the payload, as the signature case. Similar things can happen, isn't it?
Apr
16
comment Stripping off message authentication or signature
Signature over the ciphertext is also authentication, and if we apply authentication with AE, such as AES-GCM, the MAC payload can still be replaced, as it is appending like in the case of the signature. As the AES-GCM also return status code, oracle attack is still there. Isn't it?
Apr
16
asked Stripping off message authentication or signature
Mar
18
comment How much would it cost in U.S. dollars to brute force a 256 bit key in a year?
How do you map bits to ergs? Do you assume the same as above in kWh 1st?
Jul
7
awarded  Student
Jul
6
asked Generate Finite Field power of g
Dec
22
awarded  Autobiographer