Skip to main content
Polish
Source Link
fgrieu
  • 145.5k
  • 12
  • 319
  • 611

\begin{array}{ll} SignFDH_{N,d}(M) & & & &&&&&\\ \quad\quad y \leftarrow H_{FDH}(M)\\ \quad\quad \textbf{return } \sigma = y^d \bmod n\\ \end{array}\begin{array}{ll} \operatorname{SignFDH}_{N,d}(M) & & & &&&&&\\ \quad\quad y \leftarrow H_{FDH}(M)\\ \quad\quad \textbf{return } \sigma = y^d \bmod n\\ \end{array}

\begin{array}{l} VerifyFDH_{N,e}(M,\sigma) &\\ \quad\quad y \leftarrow \sigma^e \bmod N&\\ \quad\quad y \leftarrow H_{FDH}(M)&\\ \quad\quad \textbf{if } y = y' \textbf{ then return } 1 \textbf{ else return } 0\\ \end{array}\begin{array}{l} \operatorname{VerifyFDH}_{N,e}(M,\sigma) &\\ \quad\quad y \leftarrow \sigma^e \bmod N&\\ \quad\quad y \leftarrow H_{FDH}(M)&\\ \quad\quad \textbf{if } y = y' \textbf{ then return } 1 \textbf{ else return } 0\\ \end{array}

  • Can a random text that has taken the $e$-th power be a signature forgery?

    No, The forger needs to provide the message $m'$ too. During verification, the hash of the message $SHA-512(m')$$\operatorname{SHA-512}(m')$ will be taken and compared with the one in the signature.

\begin{array}{ll} SignFDH_{N,d}(M) & & & &&&&&\\ \quad\quad y \leftarrow H_{FDH}(M)\\ \quad\quad \textbf{return } \sigma = y^d \bmod n\\ \end{array}

\begin{array}{l} VerifyFDH_{N,e}(M,\sigma) &\\ \quad\quad y \leftarrow \sigma^e \bmod N&\\ \quad\quad y \leftarrow H_{FDH}(M)&\\ \quad\quad \textbf{if } y = y' \textbf{ then return } 1 \textbf{ else return } 0\\ \end{array}

  • Can a random text that has taken the $e$-th power be a signature forgery?

    No, The forger needs to provide the message $m'$ too. During verification, the hash of the message $SHA-512(m')$ will be taken and compared with the one in the signature.

\begin{array}{ll} \operatorname{SignFDH}_{N,d}(M) & & & &&&&&\\ \quad\quad y \leftarrow H_{FDH}(M)\\ \quad\quad \textbf{return } \sigma = y^d \bmod n\\ \end{array}

\begin{array}{l} \operatorname{VerifyFDH}_{N,e}(M,\sigma) &\\ \quad\quad y \leftarrow \sigma^e \bmod N&\\ \quad\quad y \leftarrow H_{FDH}(M)&\\ \quad\quad \textbf{if } y = y' \textbf{ then return } 1 \textbf{ else return } 0\\ \end{array}

  • Can a random text that has taken the $e$-th power be a signature forgery?

    No, The forger needs to provide the message $m'$ too. During verification, the hash of the message $\operatorname{SHA-512}(m')$ will be taken and compared with the one in the signature.

RSASSA-PKCS1-v1_5 is made a bit more self referenced.
Source Link
kelalaka
  • 49.5k
  • 12
  • 118
  • 205
  • PS is FFs block

    PS is FFs block and at least 8 octets (octet is 8-bit)

  • T is the H(M) and the hash algorithm identifier

    T is the H(M) and the hash algorithm identifier;

    T = AlgorithmIdentifier|digest

  • the first 0x00 guarantees that EM is less than the modulus.

    the first 0x00 guarantees that EM is less than the modulus.

  • The rest details like the size of FF block etc. can be found in rfc 8017 section 9.2

    The rest details like the real size of FF block etc. can be found in rfc 8017 section 9.2

  • PS is FFs block
  • T is the H(M) and the hash algorithm identifier
  • the first 0x00 guarantees that EM is less than the modulus.
  • The rest details like the size of FF block etc. can be found in rfc 8017 section 9.2
  • PS is FFs block and at least 8 octets (octet is 8-bit)

  • T is the H(M) and the hash algorithm identifier;

    T = AlgorithmIdentifier|digest

  • the first 0x00 guarantees that EM is less than the modulus.

  • The rest details like the real size of FF block etc. can be found in rfc 8017 section 9.2

replaced https://tools.ietf.org/html/rfc with https://www.rfc-editor.org/rfc/rfc
Source Link

Also known as RSASSA-PKCS1-v1_5RSASSA-PKCS1-v1_5 and its security is finally is given

  • PS is FFs block
  • T is the H(M) and the hash algorithm identifier
  • the first 0x00 guarantees that EM is less than the modulus.
  • The rest details like the size of FF block etc. can be found in rfc 8017 section 9.2rfc 8017 section 9.2

Also known as RSASSA-PKCS1-v1_5 and its security is finally is given

  • PS is FFs block
  • T is the H(M) and the hash algorithm identifier
  • the first 0x00 guarantees that EM is less than the modulus.
  • The rest details like the size of FF block etc. can be found in rfc 8017 section 9.2

Also known as RSASSA-PKCS1-v1_5 and its security is finally is given

  • PS is FFs block
  • T is the H(M) and the hash algorithm identifier
  • the first 0x00 guarantees that EM is less than the modulus.
  • The rest details like the size of FF block etc. can be found in rfc 8017 section 9.2
Source Link
kelalaka
  • 49.5k
  • 12
  • 118
  • 205
Loading