People who code: we want your input. Take the Survey

# Questions tagged [forgery]

Forgery is the process of making, adapting, or imitating objects, statistics, or documents with the intent to deceive. Use this tag on questions revolving around creating a forgery for a specific encryption scheme or for questions about definitions involving unforgeability.

69 questions
Filter by
Sorted by
Tagged with
23 views

### Premeditated substitution of ECDSA-signed message by the signer [migrated]

If I understand correctly section 4.2 in Jacques Stern, David Pointcheval, John Malone-Lee, and Nigel P. Smart's Flaws in Applying Proof Methodologies to Signature Schemes, in proceedings of Crypto ...
88 views

### How to use cryptography to protect video from forgery?

As Deepfake and other technologies make video anti-counterfeiting very difficult, I want to design a scheme based on cryptography to verify that a video is actually captured by the camera. At the same ...
62 views

### Forgery of the Carter-Wegman MAC

Consider the nonce-based Carter-Wegman MAC which works on key space $K=\{0,1\}^n \times \{0,1\}^n,$ message space $M=\{0,1\}^{mn}$, nonce space $N=\{0,1\}^n$ and the tag space $T=\{0,1\}^n$ as follows:...
104 views

### Textbook RSA signature forgery when e=65537

Searching about RSA signature forgery I came across this question. In the answer, it is stated that for small to moderate $e$ (including $e=3$ and $e=2^{16}+1$, often used in practice), it would be ...
128 views

862 views

### How to forge a Shamir secret share?

On this website, we have a lot of questions and answers devoted to Shamir secret sharing. We make it clear that Shamir secret sharing does not guarantee integrity. When we want integrity, we need to ...
185 views

### Universal forgery based on mathematical problem

It is known that DSA admits universal forgery under assumption that the Attacker can solve the equation $x\equiv R^x\pmod p.$ Are there any other protocols admitting universal forgery based on non-...
997 views

### Security of CBC-MAC fixed length with zero padding

I see everywhere that fixed length CBC-MAC should be more or less secure against forgery. But is it really ? Could you forge a message assuming by example that you use CBC-MAC with let's say always ...
140 views

### Knowing you can combine 2 signatures, Is it possible to remove part of the signature?

Since my last post I've been more interested into RSA cryptography, but I'm questioning one thing. Lets say we are using standard textbook RSA with no padding and with the standard signature ...
2k views

261 views

### Does using crypto_stream_xor allow listeners to forge crypto_secretbox messages?

I understand that NaCl's crypto_stream and crypto_stream_xor don't do any authentication like ...
994 views

### Forge CBC-MAC by creating a new message, given the MAC of two messages

The question is quite similar to this one : Forge CBC-MAC given the MAC of two messages and of their concatenation But I still cannot fully understand it, and here's my question: given two messages ...
1k views

### Question on MAC Forgery

In MAC forgery, is it assumed that the attacker has the secret key or not? I find this in Wikipedia but still not clear. Existential forgery is the creation (by an adversary) of at least one ...
3k views

### How difficult is it to practically detect a forgery in a cryptosystem?

If the encryption key that you use doesn't correspond to the decryption key used by the crypto system, it is assumed that it will not be possible to decrypt the message or you'll know that there has ...
88 views

### How can I resolve this basic MAC paradox I’m stumbling upon in my proof?

Suppose $S: K \times M \to T$ is a secure MAC. ($K$ = key space, $M$ = message space, $T = \{0,1\}^n$ = tag space.) $S$ being secure means that no matter what messages $m_1,...,m_q$ we throw at $S$ ...
1k views

### El Gamal existential forgery using Pointcheval–Stern signature algorithm

I found that there exists an algorithm that claims to make the El Gamal signature generation more secure. The algorithm can be found here as a pdf. I'm mainly interested in the two-parameter forgery ...
220 views

### How to forge signatures in the Schnorr scheme if $r=g^k$ is eliminated?

I need some help to demonstrate how to forge signatures in the Schnorr scheme if I eliminate the random string $r=g^k$ used in the hash – using $H(M)$ instead of $H(M||r)$. How would one be able to ...
476 views

### What is the probability of attacking SHA1 used in RSA signature with small exponent?

There is RSA signature check which has following properties: RSA modulus N which is 2048-bit RSA public exponent equal 41 (0x29) Genuine Signature uses EMSA-PKCS1-v1_5 padding of SHA1 hash, however ...
717 views

In the Mac-forge experiment, the adversary is given access to a tag-generation oracle, which generates a tag for each message given by the adversary. The adversary's task is to generate a valid tag on ...
121 views

### Does key renewal increase complexity of MAC forgery?

Suppose I have encrypted messages sent to a device authenticated with a MAC keyed with a strong shared cryptographic key. This device can only process so many messages per unit of time. This ...
712 views

### Rogue CA Certificate MD5 Collision Control

Papers from Marc Stevens et al show that X509 certificates that rely on MD5 signatures can break the assumed security model, that is, it allows for a forged certificate to have the same signature as a ...
631 views

### How bad is it to use the identity function as hash for ECDSA?

I was recently asked whether a certain library supports the ECDSAwithNone Signature algorithm. Clearly this would mean ECDSA with the identity function as the hash function. I know this is a really ...