Timeline for How robust is RSA-FDH against distribution bias?
Current License: CC BY-SA 4.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 16, 2019 at 19:59 | comment | added | Squeamish Ossifrage | Well, then the verifier has to try up to, say, 128 verifications before they can confidently conclude a forgery. With $e = 3$, maybe that's not so bad—still cheaper than a private key operation—but PSS fits the hash and randomization into $\mathbb Z/n\mathbb Z$ at zero additional cost to the verifier. | |
| Mar 16, 2019 at 17:05 | comment | added | phayes | Thanks Squeamish Ossifrage. To make this deterministic, I think we could just always initialize the iv to zero, and increment it to find a digest where digest < n. Then we don't need to pass around the IV at all. Thoughts? | |
| Mar 16, 2019 at 16:44 | comment | added | Squeamish Ossifrage | If you're happy with randomized signatures, conceivably one could do this with PSS and save the trouble of transmitting the IV—except the standard security theorems for PSS work just fine if the msb is fixed to zero anyway! | |
| Mar 15, 2019 at 23:02 | history | edited | phayes | CC BY-SA 4.0 |
added 8 characters in body
|
| Mar 15, 2019 at 23:00 | review | First posts | |||
| Mar 16, 2019 at 15:11 | |||||
| Mar 15, 2019 at 22:57 | history | answered | phayes | CC BY-SA 4.0 |