6 reputation
4
bio website
location
age
visits member for 1 year, 6 months
seen Aug 7 at 20:56

Jun
12
comment Preimage resistance hash in digital signature
$z$ in less than $n $ ! I missed to write this, sorry.
Jun
12
comment Preimage resistance hash in digital signature
C to make the attack is started from computing $y = z^e \mod n $ and then finds $m'$ such that.. My question is C can start from $m'$ and compute $z$ such that $y = z^e \mod n $ fixed $y = h(m')$ ? Thanks and sorry for my bad explaining and my bad English
Jun
12
comment Preimage resistance hash in digital signature
Let's see if C is right: Since the digital signature,for a generic message $k$ is in the form: $ H(k)^d \mod n $ where $d$ is the exponent of BOB we will have in our case: $H(m') ^d \mod n = y ^d \mod n = (z^e \mod n) ^d \mod n = z $ . So we can conclude that because hash function $h()$ is not preimage resistance Bob was screwed.
Jun
12
comment Preimage resistance hash in digital signature
Hi,thanks for your answer. I'm a student, I started to study Security a week ago, so I don't think to be able to find attack. However, Can you say what is wrong in my argument? Attacker would like to state that Bob has signed $m'$, so compute $ y = z^e \mod n $ ($z$ random ),then he finds a $m'$ such that $h(m') = y $. C states "BOB you have sent ${ m', z }$ , you have signed $m'$ with $z$ ! "