Hot answers tagged

25 votes

How difficult is it to practically detect a forgery in a cryptosystem?

There are several standard methods for cryptographically detecting forged messages: A cryptographic message authentication code (MAC) can be applied to the message, preferably after it has been ...
user avatar
25 votes
Accepted

How difficult is it to practically detect a forgery in a cryptosystem?

Confidentiality does not imply authenticity. Many common ciphers are trivially malleable—an attacker that doesn't know the key can nevertheless modify ciphertexts in ways that cause predictable ...
user avatar
21 votes
Accepted

What is the new attack on OCB2 and how does it work?

How does the attack work (on a high level)? It's an unfortunate consequence of how the pad of the last encryption block is computed. The pad can essentially be used to both eliminate the block cipher ...
user avatar
  • 3,952
16 votes
Accepted

Existential unforgeability vs strong unforgeability

It is easy to construct a signature scheme that is existentially unforgeable but not strong. All you have to do is add a bit to the end of a strong scheme, and ignore it upon verification. This ...
user avatar
12 votes
Accepted

Can you fake messages from recorded message-history?

If Bob does NOT care to check signatures (as in the question), Eve can send ANY message she wants to Bob pretending to be Alice, including but not limited to messages Eve got from Alice; all Eve needs ...
user avatar
  • 125k
9 votes
Accepted

GMAC vs HMAC in message forgery and bandwidth

Saarinen in his work GCM, GHASH and Weak Keys says that; This paper is not very clear and has led many people into regrettable confusion about universal hashing authenticators. The paper—both the ...
user avatar
7 votes
Accepted

Forgery attack for Merkle–Damgård MAC scheme with prefix method

A lot of this is explained well on the wikipedia article. The function $f$ is called the compression function. It is a function $$f:\left\{0,1\right\}^n\times\left\{0,1\right\}^\ell\to\left\{0,1\...
user avatar
6 votes

Attacking RSA signature verification that ignores padding

If you were using $e=3$, then there is a well known attack by Bleichenbacher that enables the trivial generation of a signature that passes verification. This attack was never published, but is ...
user avatar
6 votes
Accepted

Why is ECDSA secure?

We don't. As far as I know there is no proof of security for ECDSA in any model. There is, however, almost 2 decades of usage in the wild, including by Bitcoin and Ethereum, which would allow any ...
user avatar
5 votes

Question on MAC Forgery

The key part of the entry is "...where σ was not produced by the legitimate signer.". The legitimate signer is the key holder. We assume the adversary does not possess the key, but would like to have ...
user avatar
  • 19.3k
5 votes

How to forge signatures in the Schnorr scheme if $r=g^k$ is eliminated?

I suppose that you address the question to a signature scheme, in which the signature is still the pair $(r,s)$ with $r=g^k \bmod p$ as the exponentiated nonce and $$s = H(m)\cdot x + k \mod q,$$ ...
user avatar
5 votes

Attacking unuauthenticated RSA

The attack is even more simple with RSA than with symmetric keys, because the asymmetric encryption key is assumed to be public. Let me tell you a story involving Alice, Bob and Mallory :). Alice ...
user avatar
5 votes
Accepted

Is MAC-then-encrypt with stream ciphers secure?

As correctly pointed out in a comment, the authenticated encryption model assumes that the attacker knows the algorithm; the attacker can query the encryption oracle with any plaintext $P$ (and a ...
user avatar
5 votes
Accepted

Forging RSA1024 signature with e=3 where hash is right justified

When $\gcd(e, \phi(n)) = 1$, integers modulo $n$ coprime to $n$ have a unique $e$th root modulo $n$. This is the basis of RSA. Unlike for an unfactored RSA modulus, $\phi(2^{160})$ is easy to ...
user avatar
  • 2,216
4 votes
Accepted

How many bits to flip in an RSA public key to do signature forgery?

If Eve can find an $n'$ that is prime (and $n'-1$ is relatively prime to $e$),then she can easily sign any message with that $n', e$ pair. So, the question is: what is the probability that there ...
user avatar
  • 134k
4 votes

RSA signatures without padding?

One property that this unpadded system is that it is homomorphic; if $A^d = X$ and $B^d = Y$, then we know that $(AB)^d = XY$, and it doesn't matter if we don't know what $d$ is. More generally, if ...
user avatar
  • 134k
4 votes

How does hash function in Elgamal signature scheme prevent existential forgery attack?

Existential forgery attacks allow the attacker to choose (or calculate) a signature, and then the message is derived from this signature (and the public key) using the existential forgery attack ...
user avatar
4 votes
Accepted

How bad is it to use the identity function as hash for ECDSA?

There is a way to generate forgeries for (EC)DSA when the hash function is not one-way: Let $n$ be the order of the group, $P$ a generator, and $Q = aP$ for some secret $a$; Pick arbitrary $\alpha$ ...
user avatar
  • 11.7k
4 votes
Accepted

Does using crypto_stream_xor allow listeners to forge crypto_secretbox messages?

crypto_secretbox uses the first 32 bytes of XSalsa20 output as the key for Poly1305. Thus you are correct that using ...
user avatar
  • 24.1k
4 votes

How can I resolve this basic MAC paradox I’m stumbling upon in my proof?

Your attack on $S$ involves computing $S'(k,m_i)$ for arbitrary messages $m_1,\dots,m_q$. In order to do that, you must compute $S(k,m_i)$ and $S(k,0^n)$, and thus you have obtained $S(k,0^n)$. This ...
user avatar
  • 7,914
4 votes
Accepted

Is ECDSA signature strongly EUF-CMA?

From SEC1 v2.0 (§4.1, pp. 43–47), a public key is a point $Q \in E$, and a signature on a message $m$ is a pair of integers $(r, s)$ satisfying the signature equation (condensed from several steps): \...
user avatar
4 votes
Accepted

How to use cryptography to protect video from forgery?

Most video formats generate periodic key frames where the entire picture is rendered and then specify subsequent frames which are differences from the previous image. This is beneficial because this ...
user avatar
  • 1,712
3 votes
Accepted

Is this Bleichenbacher '06 style signature forgery possible? (Or more like, why isn't it?)

Now, I'm wondering about the case where an implementation does check that the hash is right-justified, but doesn't check the previous bytes at all. That case is completely broken for $e=3$ ...
user avatar
  • 134k
3 votes
Accepted

El Gamal existential forgery using Pointcheval–Stern signature algorithm

The scheme you consider is the original ElGamal signature. This scheme is known to be existentially forgeable. By definition, a valid original ElGamal signature on a message $m \in \{1, \dots, p-1\...
user avatar
  • 1,699
3 votes

Attacking RSA signature verification that ignores padding

There exist polynomial time attacks against RSA signatures with constant padding. So, this actually does not exploit the missing check for the padding. It uses index calculus The latest paper that ...
user avatar
  • 2,870
3 votes

What is the probability of attacking SHA1 used in RSA signature with small exponent?

This is not an answer; rather, I attempt to improve the method outlined in the question. Problem statement (slightly simplified): it is given an RSA public key $(N,e)$ with $2^{n-1}<N<2^n$, $n=...
user avatar
  • 125k
3 votes
Accepted

Knowing you can combine 2 signatures, Is it possible to remove part of the signature?

As soon as you are working using standard textbook RSA without padding (or hashing), you can fully exploit the malleability of the RSA cipher. So, let's say you have a message $m$ which is equal to $...
user avatar
  • 7,266
3 votes

Security of CBC-MAC fixed length with zero padding

Let's simplify this to one-block messages with a 128-bit block. Your scheme to authenticate a message whose length in bits $n$ is anywhere from 0 to 128 is $$\operatorname{MAC}_k(m) = \operatorname{...
user avatar
3 votes

GMAC vs HMAC in message forgery and bandwidth

What is the convenience of universal hashes provides? They are simple to describe: $X_i=(X_{i-1}+D_i)\cdot H$, with $D_i$ being the $i$-th data word and $H$ being a key/iv-dependent secret and are ...
user avatar
  • 44.7k
3 votes

Is it possible to cryptographically sign a message with a private key while keeping the pre-image content public?

The security of the signature schemes doesn't require the message to be encrypted. The hash algorithm and the signature algorithm parameters are publicly known and the only secret the signer's key ...
user avatar
  • 43.5k

Only top scored, non community-wiki answers of a minimum length are eligible