Tag Info

How difficult is it to practically detect a forgery in a cryptosystem?

There are several standard methods for cryptographically detecting forged messages: A cryptographic message authentication code (MAC) can be applied to the message, preferably after it has been ...
• 44.5k
Accepted

How difficult is it to practically detect a forgery in a cryptosystem?

Confidentiality does not imply authenticity. Many common ciphers are trivially malleable—an attacker that doesn't know the key can nevertheless modify ciphertexts in ways that cause predictable ...
Accepted

What is the new attack on OCB2 and how does it work?

How does the attack work (on a high level)? It's an unfortunate consequence of how the pad of the last encryption block is computed. The pad can essentially be used to both eliminate the block cipher ...
• 3,952
Accepted

Existential unforgeability vs strong unforgeability

It is easy to construct a signature scheme that is existentially unforgeable but not strong. All you have to do is add a bit to the end of a strong scheme, and ignore it upon verification. This ...
Accepted

Can you fake messages from recorded message-history?

If Bob does NOT care to check signatures (as in the question), Eve can send ANY message she wants to Bob pretending to be Alice, including but not limited to messages Eve got from Alice; all Eve needs ...
• 125k
Accepted

GMAC vs HMAC in message forgery and bandwidth

Saarinen in his work GCM, GHASH and Weak Keys says that; This paper is not very clear and has led many people into regrettable confusion about universal hashing authenticators. The paper—both the ...
Accepted

A lot of this is explained well on the wikipedia article. The function $f$ is called the compression function. It is a function $$f:\left\{0,1\right\}^n\times\left\{0,1\right\}^\ell\to\left\{0,1\... • 3,399 6 votes Attacking RSA signature verification that ignores padding If you were using e=3, then there is a well known attack by Bleichenbacher that enables the trivial generation of a signature that passes verification. This attack was never published, but is ... 6 votes Accepted Why is ECDSA secure? We don't. As far as I know there is no proof of security for ECDSA in any model. There is, however, almost 2 decades of usage in the wild, including by Bitcoin and Ethereum, which would allow any ... 5 votes Question on MAC Forgery The key part of the entry is "...where σ was not produced by the legitimate signer.". The legitimate signer is the key holder. We assume the adversary does not possess the key, but would like to have ... • 19.3k 5 votes How to forge signatures in the Schnorr scheme if r=g^k is eliminated? I suppose that you address the question to a signature scheme, in which the signature is still the pair (r,s) with r=g^k \bmod p as the exponentiated nonce and$$s = H(m)\cdot x + k \mod q,$$... 5 votes Attacking unuauthenticated RSA The attack is even more simple with RSA than with symmetric keys, because the asymmetric encryption key is assumed to be public. Let me tell you a story involving Alice, Bob and Mallory :). Alice ... • 231 5 votes Accepted Is MAC-then-encrypt with stream ciphers secure? As correctly pointed out in a comment, the authenticated encryption model assumes that the attacker knows the algorithm; the attacker can query the encryption oracle with any plaintext P (and a ... • 5,547 5 votes Accepted Forging RSA1024 signature with e=3 where hash is right justified When \gcd(e, \phi(n)) = 1, integers modulo n coprime to n have a unique eth root modulo n. This is the basis of RSA. Unlike for an unfactored RSA modulus, \phi(2^{160}) is easy to ... • 2,216 4 votes Accepted How many bits to flip in an RSA public key to do signature forgery? If Eve can find an n' that is prime (and n'-1 is relatively prime to e),then she can easily sign any message with that n', e pair. So, the question is: what is the probability that there ... • 134k 4 votes RSA signatures without padding? One property that this unpadded system is that it is homomorphic; if A^d = X and B^d = Y, then we know that (AB)^d = XY, and it doesn't matter if we don't know what d is. More generally, if ... • 134k 4 votes How does hash function in Elgamal signature scheme prevent existential forgery attack? Existential forgery attacks allow the attacker to choose (or calculate) a signature, and then the message is derived from this signature (and the public key) using the existential forgery attack ... 4 votes Accepted How bad is it to use the identity function as hash for ECDSA? There is a way to generate forgeries for (EC)DSA when the hash function is not one-way: Let n be the order of the group, P a generator, and Q = aP for some secret a; Pick arbitrary \alpha ... • 11.7k 4 votes Accepted Does using crypto_stream_xor allow listeners to forge crypto_secretbox messages? crypto_secretbox uses the first 32 bytes of XSalsa20 output as the key for Poly1305. Thus you are correct that using ... • 24.1k 4 votes How can I resolve this basic MAC paradox I’m stumbling upon in my proof? Your attack on S involves computing S'(k,m_i) for arbitrary messages m_1,\dots,m_q. In order to do that, you must compute S(k,m_i) and S(k,0^n), and thus you have obtained S(k,0^n). This ... • 7,914 4 votes Accepted Is ECDSA signature strongly EUF-CMA? From SEC1 v2.0 (§4.1, pp. 43–47), a public key is a point Q \in E, and a signature on a message m is a pair of integers (r, s) satisfying the signature equation (condensed from several steps): \... 4 votes Accepted How to use cryptography to protect video from forgery? Most video formats generate periodic key frames where the entire picture is rendered and then specify subsequent frames which are differences from the previous image. This is beneficial because this ... • 1,712 3 votes Accepted Is this Bleichenbacher '06 style signature forgery possible? (Or more like, why isn't it?) Now, I'm wondering about the case where an implementation does check that the hash is right-justified, but doesn't check the previous bytes at all. That case is completely broken for e=3 ... • 134k 3 votes Accepted El Gamal existential forgery using Pointcheval–Stern signature algorithm The scheme you consider is the original ElGamal signature. This scheme is known to be existentially forgeable. By definition, a valid original ElGamal signature on a message m \in \{1, \dots, p-1\... • 1,699 3 votes Attacking RSA signature verification that ignores padding There exist polynomial time attacks against RSA signatures with constant padding. So, this actually does not exploit the missing check for the padding. It uses index calculus The latest paper that ... • 2,870 3 votes What is the probability of attacking SHA1 used in RSA signature with small exponent? This is not an answer; rather, I attempt to improve the method outlined in the question. Problem statement (slightly simplified): it is given an RSA public key (N,e) with 2^{n-1}<N<2^n, n=... • 125k 3 votes Accepted Knowing you can combine 2 signatures, Is it possible to remove part of the signature? As soon as you are working using standard textbook RSA without padding (or hashing), you can fully exploit the malleability of the RSA cipher. So, let's say you have a message m which is equal to ... • 7,266 3 votes Security of CBC-MAC fixed length with zero padding Let's simplify this to one-block messages with a 128-bit block. Your scheme to authenticate a message whose length in bits n is anywhere from 0 to 128 is$$\operatorname{MAC}_k(m) = \operatorname{...
What is the convenience of universal hashes provides? They are simple to describe: $X_i=(X_{i-1}+D_i)\cdot H$, with $D_i$ being the $i$-th data word and $H$ being a key/iv-dependent secret and are ...