Skip to main content

Questions tagged [forgery]

Forgery is the process of making, adapting, or imitating objects, statistics, or documents with the intent to deceive. Use this tag on questions revolving around creating a forgery for a specific encryption scheme or for questions about definitions involving unforgeability.

Filter by
Sorted by
Tagged with
2 votes
0 answers
53 views

Producing existential forgery against CBC-MAC

Given the above MAC scheme, I want to ask how to form existential forgery of this scheme? I have looked through a couple explanations on existential forgery but still struggle understanding the ...
b1841837's user avatar
1 vote
0 answers
130 views

Random padding of RSA-signed message at end instead of beginning of the message

I’ve a signature scheme for 1024‒bit RSA with a 65537 exponent. The signed message is constructed as follows: 760‒Bits fully_user_controlled_message_content+8 Bits incremental nonce+sha256(...
user2284570's user avatar
1 vote
0 answers
44 views

What are the implications of BLS signature verification without checking the elements are in the prime subgroup?

Consider a BLS signature verification using BLS12-381 where signatures are in $G_1$ and public keys are in $G_2$. Verification is performed by checking that $e(sig, G2) = e(H(m), pk)$ or equivalently (...
Jack Lloyd's user avatar
  • 1,704
1 vote
1 answer
101 views

Ensure deniability of an interactive zero knowledge proof

Suppose that Peggy(prover) and Victor(verifier) are running some zero knowledge proof protocol that does not rely on hidden verifier secrets. The verifier generates randomly chosen challenge values ...
Richard Thiessen's user avatar
2 votes
1 answer
87 views

Replacing the Hash function with messages in the BLS signature scheme, the security degenerates from EUF to SUF?

​I have been thinking about this question: if I directly replace the hash function with the message in the BLS signature, does the security of the BLS degenerate from existential unforgeability(EUF) ...
X.H. Yue's user avatar
  • 392
0 votes
0 answers
94 views

Security proof of the Schnorr Signature

How Schnorr signature security can be proved for signature forgery, replacement, and Replay attacks?
SHI MA's user avatar
  • 1
1 vote
0 answers
142 views

RSA Signature Attack without Valid Message and Signature Pairs

I know about the existential forgery attack on RSA where a forgery is possible given two valid message and signature pairs but I am wondering how can a forgery be done on RSA with just the knowledge ...
CryptoGuru's user avatar
3 votes
1 answer
199 views

Can the BB'06 attack to PKCS padding be generalized?

As Bleichenbacher states, a wrong implementation of the parsing function of the padding could lead to a signature forgery attack when using a low exponent. In the provided example he assumes the ...
supergiox's user avatar
2 votes
1 answer
496 views

How does padding in RSA prevent existenial forgery attacks in RSA?

I am trying to understand how adding padding like the PKCS1.5 RSA signature scheme can prevent the existential forgery attack in RSA. Is it just by changing the structure of the message?
CryptoGuru's user avatar
2 votes
1 answer
332 views

Why can't RSA signatures be forged algebraically?

Compute $n = pq$ where p and q are prime. Fix $e$ to be coprime to $\phi(n)$. Compute $d = e^{-1} \pmod n$ and verify $ed \equiv \phi(n) \pmod n$. We sign the (hash of) a message with $s = h^{d}$. A ...
Jeffrey's user avatar
  • 33
0 votes
1 answer
367 views

Given the CBC-MAC for a message M and the key K, How could I forge a new message M' so that it has the same CBC-Mac as M

Im looking to learn about forging CBC-Macs. Given the CBC-Mac for a Message M and the Key used to encrypt the message K. Can I create a new message M' which would have the same CBC-MAC? Original ...
Tom Scott's user avatar
0 votes
1 answer
1k views

CBC-MAC Forge Attack Question

I am trying to understand how the forgery attack works when using the CBC-MAC Algorithm
CryptoGuru's user avatar
1 vote
0 answers
143 views

Security game between challenger and adversary

In Section 2.1 and Section 2.2 of the paper Strongly Unforgeable Signatures Based on Computational Diffie-Hellman" by Dan Boneh et. al.", I noticed the paragraphs quoted as "We define ...
user104092's user avatar
3 votes
1 answer
302 views

Bleichenbacher '06 signature forgery against modified PKCS1 v1.5 format

Bleichenbacher’s ’06 RSA signature forgery targets incorrect PKCS1 v1.5 implementations where padding checks are omitted and RSA keys with e = 3 are used. As per ...
0xdead10cc's user avatar
2 votes
1 answer
496 views

RSA small public exponent signature forgery - use part of the public key as ciphertext

I would like to ask you about what I think is a variation of BB'06 signature forgery¹. Unlike BB'06 where the forged signature is valid for any pkey with e=3 the one I have is valid only for one pkey. ...
Alex's user avatar
  • 23
0 votes
0 answers
122 views

Weak and Strong Unforgeability for Known Message Attacks

For signatures, there is the security goal of existential unforgeability. As seen here and noted here (german source) the security goal can be split into weak and strong unforgeability for chosen ...
Titanlord's user avatar
  • 2,307
1 vote
1 answer
414 views

Is it possible to cryptographically sign a message with a private key while keeping the pre-image content public?

Essentially, I am looking for a way for user A to create a signed message that user B can 1) verify user A wrote (ie using ecrecover) and 2) the content of the message can be read by user B without ...
A W's user avatar
  • 21
1 vote
0 answers
136 views

Proof check: Forgery for a MAC

I'm looking at the MAC defined as follows: $$\text{Mac}_k(m)=\langle r,f_k(r\oplus m)\rangle $$ where $r$ is uniformly chosen at random (each time) and $f_k$ is a PRF. Vrfy is the canonical one. I'm ...
yankovs's user avatar
  • 21
0 votes
1 answer
225 views

Reference for a formal definition of universal forgery and EUF-CMA

In many papers, I see EUF-CMA and SUF-CMA referenced as a canonical term used, but I did not find a reference paper/book that ...
cryptobeginner's user avatar
2 votes
1 answer
136 views

How does Authentication-Key Recovery for GCM work?

In his Paper "Authentication weaknesses in GCM" Ferguson describes, how some bits of the error polynomial can be set to zero, thereby increasing significantly the chance of a forgery. Q: ...
MichaelW's user avatar
  • 1,497
1 vote
1 answer
469 views

How to use cryptography to protect video from forgery?

As Deepfake and other technologies make video anti-counterfeiting very difficult, I want to design a scheme based on cryptography to verify that a video is actually captured by the camera. At the same ...
Zachary's user avatar
  • 177
1 vote
0 answers
232 views

Forgery of the Carter-Wegman MAC

Consider the nonce-based Carter-Wegman MAC which works on key space $K=\{0,1\}^n \times \{0,1\}^n,$ message space $M=\{0,1\}^{mn}$, nonce space $N=\{0,1\}^n$ and the tag space $T=\{0,1\}^n$ as follows:...
Sayantan's user avatar
3 votes
1 answer
624 views

Textbook RSA signature forgery when e=65537

Searching about RSA signature forgery I came across this question. In the answer, it is stated that for small to moderate $e$ (including $e=3$ and $e=2^{16}+1$, often used in practice), it would be ...
crquest's user avatar
  • 33
0 votes
0 answers
780 views

How to forge a CBC-MAC

I'm looking for a very clear explanation of how to forge a CBC-MAC. Given M1 = m1 and M2 = m1||m2 and M3 = m1|| m2 || m3$ and their respective MACs are MAC1 MAC2 and MAC3. How would I go about forging ...
Ben's user avatar
  • 1
0 votes
1 answer
222 views

Proof by reduction for for digital signature scheme $S_2((sk_0,sk_1), m):=(S(sk_0,m), S(sk_1,m))$

Let $(Gen,S,V)$ be a secure signature scheme (existentially unforgeable under a chosen message attack) with message space${\{0,1\}}^n$. Generate two signing/verification key ...
mike's user avatar
  • 41
0 votes
1 answer
90 views

Mac-sforge motivation for storing pairs

I don't understand why Q keeping pairs of instead of m like mac-forge solves the problem of generating a new tag on a previously authenticated message. Say, a previously authenticated message for "...
Titus Smith's user avatar
2 votes
2 answers
207 views

What is blindness and forgeability in Chaum's blind signature scheme?

I am going through the voting protocols. I know how blind signature works (Blind Signature), but why is blind signature - unconditionally ”blind”, conditionally ”unforgeable" (as highlighted in the ...
Adam Levine's user avatar
0 votes
0 answers
205 views

How to forge a signature in a custom PMAC implementation

From a crypto challenge i have the following PMAC variant where the task is to forge a signature to fulfil a specific condition: Preparation: in the finite Field GF(2^128) with the polynomial x^128 + ...
nobody's user avatar
  • 1
10 votes
1 answer
3k views

Existential unforgeability vs strong unforgeability

In the article https://crypto.stanford.edu/~dabo/pubs/papers/strongsigs.pdf there are two definitions for the security of a digital signature scheme: existential unforgeability and strong ...
Evgeni Vaknin's user avatar
4 votes
1 answer
998 views

Forgery against signature using RSAES-PKCS1-v1_5 padding

I wonder what is the security of RSAES-PKCS1-v1_5 under chosen-plaintext attack, in the context of signature verification. Notations. Let $(N,d)$ be an RSA signing key, and $(N,e)$ the corresponding ...
Roger's user avatar
  • 41
1 vote
1 answer
238 views

What is the best way to forge a tag for a determined message?

Assume a PPT adversary wants to forge a tag for a message. The adversary has oracle access to a verification function. The adversary knows that tags are generated by HMAC-SHA-256 with 128-bit key. I ...
Reza's user avatar
  • 75
3 votes
1 answer
897 views

Is ECDSA signature strongly EUF-CMA?

I read, here, that ECDSA signature is EUF-CMA but not SUF-CMA, aka sEUF-CMA (for strong existential unforgeability under adaptively chosen message attacks; see terminology there). Specifically, the ...
fgrieu's user avatar
  • 142k
0 votes
0 answers
53 views

Digital signature forging on a server, after entity authentication [duplicate]

Lets assume there is a guy called Ben, he contacts some server for a ticket number and the server returns a random number to him. Ben then signs that number and sends it back to the server, which ...
Anan's user avatar
  • 65
3 votes
0 answers
128 views

Estimating the Security of SIS-Based Signature, by verifiying a subset of coordinates?

As I understood, the GPV signature scheme works as follows: KeyGen($1^n$) : Generate a Lattice with public $A \in Z_q^{n.m}$ and a secret trapdoor $t$. Sign $m$: compute $\vec y = H(m) \in Z_q^n$ ...
abdul rahman taleb's user avatar
0 votes
1 answer
38 views

Can randomness protect a list of signatures against forgery attacks?

Suppose we have a list of signatures $S = [s_1, .., s_n]$ for a list of messages $M = [m_1, .., m_n]$, and we want to verify that $S$ is a valid signature of $M$, so each $s_i$ should be valid for ...
abdul rahman taleb's user avatar
0 votes
0 answers
39 views

CBC MAC attack using Arbitrary-length Messages [duplicate]

This is from a lecture : The adversary sees the message-tag pair(m,τ), where m= (m1,m2,...,mn)The adversary sees the message-tag pair(m′,τ′), where m′= (m′1,m′2,...,m′n)The adversary computes m''=(m1,...
Kivi's user avatar
  • 1
1 vote
1 answer
699 views

Forging RSA1024 signature with e=3 where hash is right justified

I am trying to understand (in the frame of exponent 3) how to calculate a "forgery" in the case where the desired result is: xxxxxxxxxxx[...]xxxxxxxxxxxxxxxxxxxxHHHHHHHHHHH[...]HHHHHHHH where HH = a ...
lndshrk's user avatar
  • 13
0 votes
1 answer
68 views

In W-OTS, is it trivial to forge smaller N values?

Just read about W-OTS. Since the signature is the private key hashed 256-N times, is it trivial to forge a signature with a smaller value for $N$ when having access to original signature? I.e. just ...
phi's user avatar
  • 15
0 votes
0 answers
146 views

RSA Signature Forgery - Low Public Exponent + Improper Padding Validation? [duplicate]

Consider the following custom crypto: We have a signed message M1 with corresponding signature S. We have the 1024-bit modulus <...
Mr. Llama's user avatar
  • 101
-2 votes
1 answer
1k views

What is the difference between Forgery and Chosen-Message Attacks?

I did some researches about forgery attack and chosen-message attack. For me, forgery attacks are more focused on the verifiability whereas chosen-message attacks are similar to brute-force attacks. ...
lu13's user avatar
  • 1
6 votes
2 answers
4k views

GMAC vs HMAC in message forgery and bandwidth

Saarinen in his work GCM, GHASH and Weak Keys says that: The GHASH algorithm belongs to a widely studied class of Wegman-Carter polynomial universal hashes. The security bounds known (this and ...
kelalaka's user avatar
  • 49k
3 votes
3 answers
434 views

What's wrong with this digital signature scheme?

With regards to user authentication... The server sends Alice a randomly chosen number. Alice signs the number and sends the signature back to the server. The server checks the signature using Alice'...
user avatar
18 votes
1 answer
2k views

What is the new attack on OCB2 and how does it work?

OCB2 is proposed by Rogaway, Efficient Instantiations of Tweakable Blockciphers and Refinements to Modes OCB and PMAC , and it is standardized in ISO/IEC 19772:2009. The author also provided a proof ...
kelalaka's user avatar
  • 49k
0 votes
1 answer
182 views

Why not generate the authentication key from the key and nonce in GCM?

In Galois/counter mode, the authentication key $H$ is leaked if two distinct messages are encrypted using the same nonce. If someone did end up doing that, then they would need to rekey to get a new $...
Melab's user avatar
  • 3,655
8 votes
3 answers
1k views

How to forge a Shamir secret share?

On this website, we have a lot of questions and answers devoted to Shamir secret sharing. We make it clear that Shamir secret sharing does not guarantee integrity. When we want integrity, we need to ...
dusk's user avatar
  • 1,175
2 votes
1 answer
227 views

Universal forgery based on mathematical problem

It is known that DSA admits universal forgery under assumption that the Attacker can solve the equation $x\equiv R^x\pmod p.$ Are there any other protocols admitting universal forgery based on non-...
Alexey Ustinov's user avatar
1 vote
1 answer
2k views

Security of CBC-MAC fixed length with zero padding

I see everywhere that fixed length CBC-MAC should be more or less secure against forgery. But is it really ? Could you forge a message assuming by example that you use CBC-MAC with let's say always ...
user51428's user avatar
  • 121
0 votes
1 answer
315 views

Knowing you can combine 2 signatures, Is it possible to remove part of the signature?

Since my last post I've been more interested into RSA cryptography, but I'm questioning one thing. Lets say we are using standard textbook RSA with no padding and with the standard signature ...
Raspberry Pi's user avatar
7 votes
2 answers
4k views

How to forge a textbook RSA signature?

Let $pk=(N,e)$ (resp. $sk=(N,d)$) denote the public (resp. private) key in a plain RSA signature scheme. Define the function $\textbf{Int}: \{0,1\}^* \to \mathbb{Z}_N^*$ as follows: on input string $x=...
Username Unknown's user avatar
3 votes
0 answers
72 views

What type of attacks are practical for this situation?

Here is the details: I found a web api while pentesting for a company which I cannot disclose and while doing so I found a API which signs a request of the users choice, but it adds a tag to the top ...
Raspberry Pi's user avatar