Sflash is a Multivariate signature scheme that was accepted by NESSIE in 2003, and completely broken in 2007 by a differential attack. Despite I know the total break of Sflash signature scheme and the fact that it's highly insecure to be used, I'm trying to understand an interesting technique used in this signature. My question is why in this signature, The 80bit secret $\Delta$ is concatenated to V=SHA-1(M,...) and then the first 77-bits of SHA-1(V||$\Delta$) is computed? What's wrong with a completely random 77-bit string instead of SHA-1(V||$\Delta$)? What's the advantage of using a random string which relates to the plain message M as well?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.