Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Forgery is the process of making, adapting, or imitating objects, statistics, or documents with the intent to deceive.

0
votes
1answer
60 views

Why not generate the authentication key from the key and nonce in GCM?

In Galois/counter mode, the authentication key $H$ is leaked if two distinct messages are encrypted using the same nonce. If someone did end up doing that, then they would need to rekey to get a new $...
2
votes
1answer
122 views

Universal forgery based on mathematical problem

It is known that DSA admits universal forgery under assumption that the Attacker can solve the equation $x\equiv R^x\pmod p.$ Are there any other protocols admitting universal forgery based on non-...
0
votes
1answer
214 views

Security of CBC-MAC fixed length with zero padding

I see everywhere that fixed length CBC-MAC should be more or less secure against forgery. But is it really ? Could you forge a message assuming by example that you use CBC-MAC with let's say always ...
0
votes
1answer
52 views

Knowing you can combine 2 signatures, Is it possible to remove part of the signature?

Since my last post I've been more interested into RSA cryptography, but I'm questioning one thing. Lets say we are using standard textbook RSA with no padding and with the standard signature ...
3
votes
0answers
61 views

What type of attacks are practical for this situation?

Here is the details: I found a web api while pentesting for a company which I cannot disclose and while doing so I found a API which signs a request of the users choice, but it adds a tag to the top ...
3
votes
1answer
174 views

Is this Bleichenbacher '06 style signature forgery possible? (Or more like, why isn't it?)

I assume that most of you know this, but just for the sake of context; Bleichenbacher's signature forgery (https://www.ietf.org/mail-archive/web/openpgp/current/msg00999.html) basically abuses ...
2
votes
1answer
384 views

Why is ECDSA secure?

I'm trying to understand why is this, in my opinion, counter intuitive construction secure. ECDSA is a tuple of two numbers (r, s) whose validity can be verified by public key. However I don't see the ...
0
votes
1answer
153 views

Selective Forgery of a Digital Signature - Goldwasser et al

I am working though the paper of Goldwasser, Micali and Rivest ''A Digital Signature Scheme Secure Against Adaptive Chosen- Message Attacks'' In the hierarchy of the severity of breaking the ...
1
vote
1answer
187 views

Forgery of a custom MAC

I'm trying to solve a problem that was given to me. The issue I have is that I'm missing some parts to solve it. I'm confronted with an Oracle that performs MAC on an input that can be of any length ...
5
votes
1answer
535 views

Forgery attack for Merkle–Damgård MAC scheme with prefix method

Consider a hash function $H$ based on an iterated hash function $H_0$ with $l$-bit block messages an the Merkle–Damgård strenghtening pad. That is, $m||pad(m)$ has a length multiple of $l$ and $H(...
14
votes
3answers
3k views

How difficult is it to practically detect a forgery in a cryptosystem?

If the encryption key that you use doesn't correspond to the decryption key used by the crypto system, it is assumed that it will not be possible to decrypt the message or you'll know that there has ...
3
votes
2answers
77 views

How can I resolve this basic MAC paradox I’m stumbling upon in my proof?

Suppose $S: K \times M \to T$ is a secure MAC. ($K$ = key space, $M$ = message space, $T = \{0,1\}^n$ = tag space.) $S$ being secure means that no matter what messages $m_1,...,m_q$ we throw at $S$ ...
2
votes
1answer
495 views

El Gamal existential forgery using Pointcheval–Stern signature algorithm

I found that there exists an algorithm that claims to make the El Gamal signature generation more secure. The algorithm can be found here as a pdf. I'm mainly interested in the two-parameter forgery ...
7
votes
1answer
126 views

How to forge signatures in the Schnorr scheme if $r=g^k$ is eliminated?

I need some help to demonstrate how to forge signatures in the Schnorr scheme if I eliminate the random string $r=g^k$ used in the hash – using $H(M)$ instead of $H(M||r)$. How would one be able to ...
3
votes
1answer
339 views

What is the probability of attacking SHA1 used in RSA signature with small exponent?

There is RSA signature check which has following properties: RSA modulus N which is 2048-bit RSA public exponent equal 41 (0x29) Genuine Signature uses EMSA-PKCS1-v1_5 padding of SHA1 hash, however ...
3
votes
0answers
200 views

Can a secure MAC break if the adversary is given oracle access to Verify?

In the Mac-forge experiment, the adversary is given access to a tag-generation oracle, which generates a tag for each message given by the adversary. The adversary's task is to generate a valid tag on ...
3
votes
1answer
98 views

Does key renewal increase complexity of MAC forgery?

Suppose I have encrypted messages sent to a device authenticated with a MAC keyed with a strong shared cryptographic key. This device can only process so many messages per unit of time. This ...
1
vote
1answer
435 views

Rogue CA Certificate MD5 Collision Control

Papers from Marc Stevens et al show that X509 certificates that rely on MD5 signatures can break the assumed security model, that is, it allows for a forged certificate to have the same signature as a ...
3
votes
1answer
389 views

How bad is it to use the identity function as hash for ECDSA?

I was recently asked whether a certain library supports the ECDSAwithNone Signature algorithm. Clearly this would mean ECDSA with the identity function as the hash function. I know this is a really ...
15
votes
2answers
841 views

Attacking RSA signature verification that ignores padding

I am looking at a RSA signature verification that is quite obviously flawed and am wondering if there's a way to exploit that flaw in practice. Signature is generated using RSA with PKCS 1.5 padding, ...
3
votes
1answer
1k views

RSA signatures without padding?

Suppose I have a message $M$ for which I generate an RSA-2048 digital signature as follows: $H = H(M)$, $H(M)$ being the SHA-256 of the message $M$ $S = H^d \bmod N$ Assume $N = pq$ is properly ...
1
vote
1answer
160 views

Forgery attack on OCB

When using same nonce in OCB mode of authenticated encryption, how forgery attack can be done?
2
votes
2answers
990 views

How does hash function in Elgamal signature scheme prevent existential forgery attack?

I have heard that hashing the message M prevents an existential forgery attack. I was wondering how.
3
votes
2answers
272 views

Attacking unuauthenticated RSA

In symmetric cryptography, a scheme is not considered secure if the data transmitted is only encrypted. The adversary will be able to modify messages to generate encrypted messages of his choice ...
6
votes
2answers
709 views

Can you fake messages from recorded message-history?

Lets assume Eve has a lot of PGP conversation with Alice and records all those messages. Bob is also regularly communicating with PGP with Alice. If Bob doesn't care about not having a signature ...
2
votes
1answer
391 views

Is MAC-then-encrypt with stream ciphers secure?

While thinking about this recent question about a hash-then encrypt design, I reread the MAC-encrypt vs. encrypt-MAC question and noticed this answer quoting a paper showing that MAC-then-encrypt is ...
33
votes
3answers
27k views

Why hash the message before signing it with RSA?

The diagram below illustrates the process of digitally signing a message with RSA: As diagram shows, the message is first hashed, and the signature is then computed on the hash, rather than on the ...
6
votes
2answers
1k views

RSA Signature Weak Padding Attack

Assume that we have a message $m$ of size $n$, and it is padded with two 01 bytes in front. Then the signature $s$ is computed using a private key $ks$. Can we ...
1
vote
1answer
1k views

Understanding the “cube-root math” behind an RSA signature forgery

I'm trying to understand the math outlined in this paper on a RSA signature forgery attack. I understand it except for one aspect of how the cube root (that makes the forged signature) is computed. ...
4
votes
2answers
341 views

Why do we need to hash both the message and the $h$ value in ElGamal signature?

The professor left us a question on ElGamal signatures: Given the hash function $H$ and message $M$, choose a random $r$ and compute $h=g^r$ and $H(M||h)$. Show that, if $H(M)$ is used instead of $...
2
votes
1answer
680 views

ElGamal signature: Forging a signature of a specific form

I have a question I can't solve from one of the courses I'm currently taking: Show that given a legitimate ElGamal signature $(S,R)$ on a given message $m$, an attacker can compute a signature ...
4
votes
1answer
2k views

Can we trust digital signatures?

Consider that Alice wants to send a digitally signed message to Bob. Mallory might be able to publish his public key under Alice's name and then impersonate Alice to send a message with an apparently ...
9
votes
3answers
3k views

Lamport signature: How many signatures are needed to forge a signature?

Lamport signature: Signing the message Note that now Alice's private key is used and should never be used again. The other 256 random numbers that she did not use for the signature she must never ...
4
votes
1answer
1k views

Efficient and stateless anti-forgery method

One use of an anti-forgery token is to prevent Cross-Site Request Forgery (CSRF) attacks. The attacker doesn't need to sniff the wire in order to carry out a CSRF attack. This attack relays on the ...