Linked Questions

72 votes
1 answer

Easy explanation of "IND-" security notions?

There are many schemes that can advertise themselves with certain security notions, usually IND-CPA or IND-CCA2, for example plain ElGamal has IND-CPA security but doesn't provide IND-CCA security. ...
SEJPM's user avatar
  • 46.1k
10 votes
2 answers

If I have enough examples of a private key's signature, can I discern it?

I understand that you can't discern a private key from a public key, but what if you have thousands of examples of the private key signatures, and you know what the message/cypher is? Basically, you ...
Costa Michailidis's user avatar
8 votes
2 answers

Prove the Security of Schnorr's Signature Scheme

I know that Schnorr's signature is important since it is one of the most compact signature schemes whose security has been proved in the random oracle model. Now, I want to know if such proof is ...
richard's user avatar
  • 178
4 votes
2 answers

What does existential unforgeability mean in a digital signature scheme?

In a digital signature scheme (Gen, Sign, Verfiy) that satisfies correctness and existential unforgeability, can you assume that the outputs of Sign() are computationally indistinguishable from random?...
opposite-people's user avatar
1 vote
2 answers

Why is SHA256 used as a layer on top of Digital Signature [duplicate]

Digital Signatures use an asymmetric algorithm, meaning that if I want to apply a digital signature to a document I sign it with my own private key and send it to the recipient. The recipient, thanks ...
Tarta's user avatar
  • 129
5 votes
2 answers

RSA Signing - Existential forgery and message prefix question. It's a weird one

I'm new to this. Please be kind. I have a theoretical question that I would like sanity checked: Bob and Alice are doing RSA signing without a hash function -- just putting a message in, and getting a ...
Kendrick Taylor's user avatar
2 votes
3 answers

Benefits of signing RSA-encrypted data?

I recently came across this (PDF) journal article, which describes what it calls "A New Design Of A Hybrid Encryption Algorithm" (which I must say, doesn't sound very novel, even in 2014!): An AES ...
Cocowalla's user avatar
  • 450
3 votes
2 answers

Is it ever OK to to sign RSA messages with padding random bytes?

If a message is padded with cryptographically secure random bytes, is there any reason why this would be less secure than the standard signature padding schemes (PKCS1 v1.5 and PSS)? To give context ...
fiftytwocards's user avatar
7 votes
3 answers

Is there a cryptographic approach to availability

Background Cryptography can be said to provide the tools used to fulfill the goals of information security. The three pillars of information security are confidentiality, integrity, and ...
Ella Rose's user avatar
  • 19.7k
7 votes
2 answers

Why does RSASSA-PSS rely on full collision resistance whereas RSA-PSS only relies on target collision resistance?

This is sort-of a reply to the top answer given to this question, which states that whereas RSA-PSS, defined in terms of $H(r \ || \ M)$, only relies on target collision resistance and is secure even ...
whatf0xx's user avatar
  • 203
6 votes
2 answers

Are tags longer than 128 bit possible for AES-256-CCM and AES-256-GCM?

I have an existing application that uses AES-256-CBC for encrypting data blocks, and HMAC-SHA-256 on the plaintext for eliminating duplicate data blocks. For performance reasons, I would like to move ...
Aron's user avatar
  • 63
3 votes
1 answer

Is it possible to combine digital signature to provide message addition?

Let's assume we are using the textbook RSA where $Sig(x)=x^d$. Alice has public key $(e,N)$, and private key $(d,p,q)$. Now, if Alice sends $Sig(5)$ and $Sig(10)$ to Bob, where $5$ and $10$ is just ...
NuminousName's user avatar
2 votes
1 answer

What exactly is a digital signature?

I am aware of basics of public key encryption algorithms , for eg. RSA. If A wants to send a message to B, A uses the public key of B to encrypt the message A wants to send to B, and only B can ...
john doe's user avatar
  • 121
3 votes
1 answer

When using ECDSA P-384 for signing and verifying messages, should the public key be also included **INSIDE** the message before signing?

I am using ECDSA P-384 for signing and verifying messages. The messages are basically stringified JSON. After receiving, the recipient verifies the signature using the public key. Should the public ...
sudoExclamationExclamation's user avatar
3 votes
1 answer

Is ECDSA signature strongly EUF-CMA?

I read, here, that ECDSA signature is EUF-CMA but not SUF-CMA, aka sEUF-CMA (for strong existential unforgeability under adaptively chosen message attacks; see terminology there). Specifically, the ...
fgrieu's user avatar
  • 141k

15 30 50 per page