In Elgamal signature scheme $\text{sig}_{k_{pr}}(x,k_E)=(r,s)$, $s=0$ is not allowed. How does this lead to finding the private key $d$?
$\begingroup$
$\endgroup$
4
-
$\begingroup$ Did you check that the signature can be verifiable? $\endgroup$– kelalakaCommented Jan 4, 2022 at 16:45
-
1$\begingroup$ Thanks. For verification we should have $\beta^r.r^s \bmod p=\alpha^x$, which in this particular case leads to $\alpha^{d.r+0}\neq \alpha^x$. And using hash functions will not solve this problem, is it true? $\endgroup$– Mohammadsadeq BorjiyanCommented Jan 4, 2022 at 19:39
-
$\begingroup$ The $m$ should be already the hash of the message, otherwise, the signature space will be limited. I couldn't find a dupe for this. If you want you can write an answer to your question. $\endgroup$– kelalakaCommented Jan 4, 2022 at 19:55
-
$\begingroup$ Thanks dear Henry. $\endgroup$– Mohammadsadeq BorjiyanCommented Jan 4, 2022 at 20:55
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
1
For $s=0$, we will have problem verifying the signature. For verification, we should have $\beta^r \cdot r^s=\alpha^x$. This special case, $s=0$, leads to $\beta^r \cdot r^0=\beta^r=\alpha^{d \cdot r}$ which must be equal to $\alpha^x$, i.e. $d \cdot r=x$, but $d \cdot r$ is equal for every $x$ and this have no meaning.
-
$\begingroup$ That is more than that. $r$ is public in the signature, then you find the $d$ :) $\endgroup$– kelalakaCommented Jan 4, 2022 at 21:06