Edge7
Reputation
Top tag
Next privilege 10 Rep.
 Jun 12 comment Preimage resistance hash in digital signature $z$ in less than $n$ ! I missed to write this, sorry. Jun 12 comment Preimage resistance hash in digital signature C to make the attack is started from computing $y = z^e \mod n$ and then finds $m'$ such that.. My question is C can start from $m'$ and compute $z$ such that $y = z^e \mod n$ fixed $y = h(m')$ ? Thanks and sorry for my bad explaining and my bad English Jun 12 comment Preimage resistance hash in digital signature Let's see if C is right: Since the digital signature,for a generic message $k$ is in the form: $H(k)^d \mod n$ where $d$ is the exponent of BOB we will have in our case: $H(m') ^d \mod n = y ^d \mod n = (z^e \mod n) ^d \mod n = z$ . So we can conclude that because hash function $h()$ is not preimage resistance Bob was screwed. Jun 12 comment Preimage resistance hash in digital signature Hi,thanks for your answer. I'm a student, I started to study Security a week ago, so I don't think to be able to find attack. However, Can you say what is wrong in my argument? Attacker would like to state that Bob has signed $m'$, so compute $y = z^e \mod n$ ($z$ random ),then he finds a $m'$ such that $h(m') = y$. C states "BOB you have sent ${ m', z }$ , you have signed $m'$ with $z$ ! "