People who code: we want your input. Take the Survey

Questions tagged [forgery]

Forgery is the process of making, adapting, or imitating objects, statistics, or documents with the intent to deceive. Use this tag on questions revolving around creating a forgery for a specific encryption scheme or for questions about definitions involving unforgeability.

Filter by
Sorted by
Tagged with
1
vote
0answers
23 views

Premeditated substitution of ECDSA-signed message by the signer [migrated]

If I understand correctly section 4.2 in Jacques Stern, David Pointcheval, John Malone-Lee, and Nigel P. Smart's Flaws in Applying Proof Methodologies to Signature Schemes, in proceedings of Crypto ...
1
vote
1answer
88 views

How to use cryptography to protect video from forgery?

As Deepfake and other technologies make video anti-counterfeiting very difficult, I want to design a scheme based on cryptography to verify that a video is actually captured by the camera. At the same ...
1
vote
0answers
62 views

Forgery of the Carter-Wegman MAC

Consider the nonce-based Carter-Wegman MAC which works on key space $K=\{0,1\}^n \times \{0,1\}^n,$ message space $M=\{0,1\}^{mn}$, nonce space $N=\{0,1\}^n$ and the tag space $T=\{0,1\}^n$ as follows:...
2
votes
1answer
104 views

Textbook RSA signature forgery when e=65537

Searching about RSA signature forgery I came across this question. In the answer, it is stated that for small to moderate $e$ (including $e=3$ and $e=2^{16}+1$, often used in practice), it would be ...
0
votes
0answers
128 views

How to forge a CBC-MAC

I'm looking for a very clear explanation of how to forge a CBC-MAC. Given M1 = m1 and M2 = m1||m2 and M3 = m1|| m2 || m3$ and their respective MACs are MAC1 MAC2 and MAC3. How would I go about forging ...
0
votes
1answer
77 views

Proof by reduction for for digital signature scheme $S_2((sk_0,sk_1), m):=(S(sk_0,m), S(sk_1,m))$

Let $(Gen,S,V)$ be a secure signature scheme (existentially unforgeable under a chosen message attack) with message space${\{0,1\}}^n$. Generate two signing/verification key ...
0
votes
1answer
36 views

Mac-sforge motivation for storing pairs

I don't understand why Q keeping pairs of instead of m like mac-forge solves the problem of generating a new tag on a previously authenticated message. Say, a previously authenticated message for "...
2
votes
2answers
117 views

What is blindness and forgeability in Chaum's blind signature scheme?

I am going through the voting protocols. I know how blind signature works (Blind Signature), but why is blind signature - unconditionally ”blind”, conditionally ”unforgeable" (as highlighted in the ...
0
votes
0answers
59 views

How to forge a signature in a custom PMAC implementation

From a crypto challenge i have the following PMAC variant where the task is to forge a signature to fulfil a specific condition: Preparation: in the finite Field GF(2^128) with the polynomial x^128 + ...
9
votes
1answer
1k views

Existential unforgeability vs strong unforgeability

In the article https://crypto.stanford.edu/~dabo/pubs/papers/strongsigs.pdf there are two definitions for the security of a digital signature scheme: existential unforgeability and strong ...
3
votes
1answer
306 views

Forgery against signature using RSAES-PKCS1-v1_5 padding

I wonder what is the security of RSAES-PKCS1-v1_5 under chosen-plaintext attack, in the context of signature verification. Notations. Let $(N,d)$ be an RSA signing key, and $(N,e)$ the corresponding ...
1
vote
1answer
77 views

What is the best way to forge a tag for a determined message?

Assume a PPT adversary wants to forge a tag for a message. The adversary has oracle access to a verification function. The adversary knows that tags are generated by HMAC-SHA-256 with 128-bit key. I ...
3
votes
1answer
344 views

Is ECDSA signature strongly EUF-CMA?

I read, here, that ECDSA signature is EUF-CMA but not SUF-CMA, aka sEUF-CMA (for strong existential unforgeability under adaptively chosen message attacks; see terminology there). Specifically, the ...
0
votes
0answers
51 views

Digital signature forging on a server, after entity authentication [duplicate]

Lets assume there is a guy called Ben, he contacts some server for a ticket number and the server returns a random number to him. Ben then signs that number and sends it back to the server, which ...
2
votes
0answers
61 views

Estimating the Security of SIS-Based Signature, by verifiying a subset of coordinates?

As I understood, the GPV signature scheme works as follows: KeyGen($1^n$) : Generate a Lattice with public $A \in Z_q^{n.m}$ and a secret trapdoor $t$. Sign $m$: compute $\vec y = H(m) \in Z_q^n$ ...
0
votes
1answer
33 views

Can randomness protect a list of signatures against forgery attacks?

Suppose we have a list of signatures $S = [s_1, .., s_n]$ for a list of messages $M = [m_1, .., m_n]$, and we want to verify that $S$ is a valid signature of $M$, so each $s_i$ should be valid for ...
0
votes
0answers
29 views

CBC MAC attack using Arbitrary-length Messages [duplicate]

This is from a lecture : The adversary sees the message-tag pair(m,τ), where m= (m1,m2,...,mn)The adversary sees the message-tag pair(m′,τ′), where m′= (m′1,m′2,...,m′n)The adversary computes m''=(m1,...
1
vote
1answer
277 views

Forging RSA1024 signature with e=3 where hash is right justified

I am trying to understand (in the frame of exponent 3) how to calculate a "forgery" in the case where the desired result is: xxxxxxxxxxx[...]xxxxxxxxxxxxxxxxxxxxHHHHHHHHHHH[...]HHHHHHHH where HH = a ...
0
votes
1answer
63 views

In W-OTS, is it trivial to forge smaller N values?

Just read about W-OTS. Since the signature is the private key hashed 256-N times, is it trivial to forge a signature with a smaller value for $N$ when having access to original signature? I.e. just ...
0
votes
0answers
83 views

RSA Signature Forgery - Low Public Exponent + Improper Padding Validation? [duplicate]

Consider the following custom crypto: We have a signed message M1 with corresponding signature S. We have the 1024-bit modulus <...
-1
votes
1answer
526 views

What is the difference between Forgery and Chosen-Message Attacks?

I did some researches about forgery attack and chosen-message attack. For me, forgery attacks are more focused on the verifiability whereas chosen-message attacks are similar to brute-force attacks. ...
5
votes
2answers
2k views

GMAC vs HMAC in message forgery and bandwidth

Saarinen in his work GCM, GHASH and Weak Keys says that: The GHASH algorithm belongs to a widely studied class of Wegman-Carter polynomial universal hashes. The security bounds known (this and ...
2
votes
3answers
362 views

What's wrong with this digital signature scheme?

With regards to user authentication... The server sends Alice a randomly chosen number. Alice signs the number and sends the signature back to the server. The server checks the signature using Alice'...
18
votes
1answer
1k views

What is the new attack on OCB2 and how does it work?

OCB2 is proposed by Rogaway, Efficient Instantiations of Tweakable Blockciphers and Refinements to Modes OCB and PMAC , and it is standardized in ISO/IEC 19772:2009. The author also provided a proof ...
0
votes
1answer
160 views

Why not generate the authentication key from the key and nonce in GCM?

In Galois/counter mode, the authentication key $H$ is leaked if two distinct messages are encrypted using the same nonce. If someone did end up doing that, then they would need to rekey to get a new $...
7
votes
3answers
862 views

How to forge a Shamir secret share?

On this website, we have a lot of questions and answers devoted to Shamir secret sharing. We make it clear that Shamir secret sharing does not guarantee integrity. When we want integrity, we need to ...
2
votes
1answer
185 views

Universal forgery based on mathematical problem

It is known that DSA admits universal forgery under assumption that the Attacker can solve the equation $x\equiv R^x\pmod p.$ Are there any other protocols admitting universal forgery based on non-...
1
vote
1answer
997 views

Security of CBC-MAC fixed length with zero padding

I see everywhere that fixed length CBC-MAC should be more or less secure against forgery. But is it really ? Could you forge a message assuming by example that you use CBC-MAC with let's say always ...
0
votes
1answer
140 views

Knowing you can combine 2 signatures, Is it possible to remove part of the signature?

Since my last post I've been more interested into RSA cryptography, but I'm questioning one thing. Lets say we are using standard textbook RSA with no padding and with the standard signature ...
7
votes
2answers
2k views

How to forge a textbook RSA signature?

Let $pk=(N,e)$ (resp. $sk=(N,d)$) denote the public (resp. private) key in a plain RSA signature scheme. Define the function $\textbf{Int}: \{0,1\}^* \to \mathbb{Z}_N^*$ as follows: on input string $x=...
3
votes
0answers
70 views

What type of attacks are practical for this situation?

Here is the details: I found a web api while pentesting for a company which I cannot disclose and while doing so I found a API which signs a request of the users choice, but it adds a tag to the top ...
4
votes
1answer
659 views

Is this Bleichenbacher '06 style signature forgery possible? (Or more like, why isn't it?)

I assume that most of you know this, but just for the sake of context; Bleichenbacher's signature forgery (https://www.ietf.org/mail-archive/web/openpgp/current/msg00999.html) basically abuses ...
5
votes
1answer
1k views

Why is ECDSA secure?

I'm trying to understand why is this, in my opinion, counter intuitive construction secure. ECDSA is a tuple of two numbers (r, s) whose validity can be verified by public key. However I don't see the ...
0
votes
1answer
416 views

Selective Forgery of a Digital Signature - Goldwasser et al

I am working though the paper of Goldwasser, Micali and Rivest ''A Digital Signature Scheme Secure Against Adaptive Chosen- Message Attacks'' In the hierarchy of the severity of breaking the ...
1
vote
1answer
406 views

Forgery of a custom MAC

I'm trying to solve a problem that was given to me. The issue I have is that I'm missing some parts to solve it. I'm confronted with an Oracle that performs MAC on an input that can be of any length ...
5
votes
1answer
2k views

Forgery attack for Merkle–Damgård MAC scheme with prefix method

Consider a hash function $H$ based on an iterated hash function $H_0$ with $l$-bit block messages an the Merkle–Damgård strenghtening pad. That is, $m||pad(m)$ has a length multiple of $l$ and $H(...
3
votes
1answer
261 views

Does using crypto_stream_xor allow listeners to forge crypto_secretbox messages?

I understand that NaCl's crypto_stream and crypto_stream_xor don't do any authentication like ...
1
vote
1answer
994 views

Forge CBC-MAC by creating a new message, given the MAC of two messages

The question is quite similar to this one : Forge CBC-MAC given the MAC of two messages and of their concatenation But I still cannot fully understand it, and here's my question: given two messages ...
1
vote
2answers
1k views

Question on MAC Forgery

In MAC forgery, is it assumed that the attacker has the secret key or not? I find this in Wikipedia but still not clear. Existential forgery is the creation (by an adversary) of at least one ...
14
votes
3answers
3k views

How difficult is it to practically detect a forgery in a cryptosystem?

If the encryption key that you use doesn't correspond to the decryption key used by the crypto system, it is assumed that it will not be possible to decrypt the message or you'll know that there has ...
2
votes
2answers
88 views

How can I resolve this basic MAC paradox I’m stumbling upon in my proof?

Suppose $S: K \times M \to T$ is a secure MAC. ($K$ = key space, $M$ = message space, $T = \{0,1\}^n$ = tag space.) $S$ being secure means that no matter what messages $m_1,...,m_q$ we throw at $S$ ...
3
votes
1answer
1k views

El Gamal existential forgery using Pointcheval–Stern signature algorithm

I found that there exists an algorithm that claims to make the El Gamal signature generation more secure. The algorithm can be found here as a pdf. I'm mainly interested in the two-parameter forgery ...
7
votes
1answer
220 views

How to forge signatures in the Schnorr scheme if $r=g^k$ is eliminated?

I need some help to demonstrate how to forge signatures in the Schnorr scheme if I eliminate the random string $r=g^k$ used in the hash – using $H(M)$ instead of $H(M||r)$. How would one be able to ...
3
votes
1answer
476 views

What is the probability of attacking SHA1 used in RSA signature with small exponent?

There is RSA signature check which has following properties: RSA modulus N which is 2048-bit RSA public exponent equal 41 (0x29) Genuine Signature uses EMSA-PKCS1-v1_5 padding of SHA1 hash, however ...
4
votes
0answers
717 views

Can a secure MAC break if the adversary is given oracle access to Verify?

In the Mac-forge experiment, the adversary is given access to a tag-generation oracle, which generates a tag for each message given by the adversary. The adversary's task is to generate a valid tag on ...
2
votes
1answer
121 views

Does key renewal increase complexity of MAC forgery?

Suppose I have encrypted messages sent to a device authenticated with a MAC keyed with a strong shared cryptographic key. This device can only process so many messages per unit of time. This ...
1
vote
1answer
712 views

Rogue CA Certificate MD5 Collision Control

Papers from Marc Stevens et al show that X509 certificates that rely on MD5 signatures can break the assumed security model, that is, it allows for a forged certificate to have the same signature as a ...
3
votes
1answer
631 views

How bad is it to use the identity function as hash for ECDSA?

I was recently asked whether a certain library supports the ECDSAwithNone Signature algorithm. Clearly this would mean ECDSA with the identity function as the hash function. I know this is a really ...
15
votes
2answers
2k views

Attacking RSA signature verification that ignores padding

I am looking at a RSA signature verification that is quite obviously flawed and am wondering if there's a way to exploit that flaw in practice. Signature is generated using RSA with PKCS 1.5 padding, ...
2
votes
1answer
632 views

How many bits to flip in an RSA public key to do signature forgery?

Scenario: Alice wants to verify a signature from Bob. Alice knows Bob's RSA public key (e, n). However, Alice is getting the data, the signature of the data and the public key from an attacker Eve. ...