Suppose $m$ is the message that the Eve attacker wants to sign with the RSA signature scheme with the public key $(n, e)$ and the private key $(n, d)$. Suppose the signer Eve is given oracle access to the signing algorithm for any other message such as $m'$, where $m'$ with $m' \neq m$. How can Eve calculate the signature of the message $m$?
$\begingroup$
$\endgroup$
7
-
2$\begingroup$ What does 'opposite' mean? And, is RSA padding used, or is this 'textbook RSA'? $\endgroup$– ponchoCommented Jun 30, 2022 at 13:54
-
$\begingroup$ Opposite mean's m != m' and used school book RSA $\endgroup$– Star sCommented Jun 30, 2022 at 18:29
-
1$\begingroup$ I think this is a homework question, and I think you are misunderstanding the term "opposite". $\endgroup$– Maarten Bodewes ♦Commented Jul 1, 2022 at 13:41
-
$\begingroup$ Are you saying that the signer is willing to sign any $m'$ that Eve specifies, as long as $m' \ne m$? $\endgroup$– ponchoCommented Jul 1, 2022 at 13:49
-
$\begingroup$ Yes that's right. $\endgroup$– Star sCommented Jul 1, 2022 at 13:55
|
Show 2 more comments
1 Answer
$\begingroup$
$\endgroup$
4
Not sure if this answers your question because the the question is a bit unclear (I tried to edit it, but I don't know if it will be accepted).
Anyways take a look at this for example :
- Eve sends for encryption to the oracle this : $km$ where both $k, n$ in $\mathbb{Z}_n$.
- Gets back $r_1 = (kn)^d$.
- Sends for encryption $k$ to the oracle.
- Gets back $r_2 = k^d$.
- Calculates $k=r_2^{-1}$.
- Calculates $kr_1$
-
2$\begingroup$ Typically, we don't give out straight answers to obvious homework questions. I would note that this answer can be simplified if we just take $k = n-1$ (where $n$ is the modulus, not the value you select in step 1); steps 3-5 then become trivial... $\endgroup$– ponchoCommented Jul 2, 2022 at 2:39
-
-
1$\begingroup$ @JAAAY : you can leave it; but next time it's a good idea to think about our policy on that, also this. And since your answer is there, I suggest to proofread: in 1 and 2 you want to change one $n$ to $m$. In 6, it's not crystal clear it's actually calculated $r_2^{-1}r_1$. The way to fix this is either to use poncho's suggestion, or to keep yours and introduce $r'_2=r_2^{-1}$, then compute $r'_2r_1$. Also an explanation that the calculations are made $\pmod n$ might help the OP. $\endgroup$– fgrieu ♦Commented Jul 2, 2022 at 15:45
-
$\begingroup$ Note: in general, $k$ of step 5 is not $k$ of steps 1 and 2. It can be though: just set $k=n-1$, in which case steps 3/4/5 are unnecessary. $\endgroup$– fgrieu ♦Commented Jul 4, 2022 at 6:36