This is Oxford's computer security exam question:

Suppose that Bob has published an RSA encryption key $ke$ (retaining in secret the corresponding decryption key $kd$), and Alice has published a public RSA verification key $kv$ (retaining in secret the corresponding signing key $ks$). Alice wants to send an integrity protected and confidential message $m$ to Bob by transmitting the pair:

$E_{ke}(m)$, $SIGN_{ks}(E_{ke}(m))$

Bob will perform the obvious decryption and verification, rejecting messages which are incorrectly signed or have incorrect padding. However, Alice and Bob use defective padding schemes. The encryption process RSA encrypts the byte string ‘padding 00 message’, where "padding" contains random nonzero bytes, 00 indicates a single zero byte, and message is the intended message (which is assumed to fit within the RSA modulus). The signature process RSA-signs the byte string ‘01 01 message’ (and again the message is assumed to fit within the modulus in this format).
Greedy is an active attacker who intercepts Alice’s communication to Bob. He knows that the message contains a sum of money which is to be transferred by Bob (a bank) to Greedy himself. Show how Greedy can tamper with Alice’s message to give himself a non-negligible chance of getting very rich.

I have read RSA Encryption and Signature - Weak Padding but the attack found in that question can not control the content of $m$. Can anyone show me how to answer this question?

  • $\begingroup$ Do Alice and Bob use the same modulus? $\;$ $\endgroup$
    – user991
    Jun 6, 2014 at 7:58
  • $\begingroup$ @RickyDemer : I think they are different, this is the exact original exam question. $\endgroup$ Jun 6, 2014 at 9:03


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.