11
The article is surely wrong.
Nowadays, the sole purpose of client-side private key in SSH is to sign messages (as their algorithms are typically ECDSA EdDSA, etc), the server doesn't encrypt the challenge, it almost certainly verifies it with the public key(s) in the authorized_keys file
4
It's the probability that an ECDSA signature (over the Bitcoin curve, secp256k1) will have the corresponding size. In other words, 25% of the secp256k1 ECDSA signatures have 73 bytes, 50% of them have 72 bytes and 25% of them have 71 bytes. Of course, after the signature is generated its size is settled and the probability does not apply anymore.
(The ...
3
When Alice and Bob are using a message authentication code (MAC) scheme, both of them have the shared MAC key, and both of them can generate valid MAC tags. Between Alice and Bob, they can be sure who is the sender. For example, if Bob receives a message with a valid MAC, and the message was not sent by himself, then the message must come from Alice. Hence "...
2
The authentication tag is the output parameter, like in AES-GCM, which is generated by the symmetric key to authenticate the message.
$$(c,tag) = \operatorname{AES-GCM-Enc}(key,m,IV,AD)$$
Where $A$ is the Associated Data. The tag is verified by the same key, IV, and AD.
$$(\{T,F\},m?) = \operatorname{AES-GCM-Dec}(key,c,IV,tag,AD)$$ The tag verification ...
2
As for the first question: as long as you create a signature over some or all data that is required and unique in the key establishment protocol then you should get entity authentication for that session. If you sign entire messages then you may be able to avoid some attacks on the message format itself. Some protocols deliberately include the public key ...
answered Dec 3 at 21:28
2
Would it be possible to create a signature scheme like this:
As I understand it, your proposal is that the signature consists of the MAC key, along with the signed MAC value of the message.
In general, this would not be secure, for two reasons:
For many MACs, it is not difficult, if you know the key, to find a second message with the same MAC as an ...
1
Less than satisfactory partial answer, which no longer fits a comment.
With $N$ of $k$ bytes and message of $l$ bytes, a (signature, message) pair with random signature is accepted by the most stringent verification oracle with probability $$2^{-8l-24}\;(2^{8k}/N)\;\left(1-2^{-8}\right)^{k-l-3}$$
For 2048-bit $N$ and small $l$, that's about $2^{-8l-25}$. ...
1
It is desired a Unique Non-Reproducible ID (UNRID) which genuineness is publicly verifiable.
I know no standard for that. But we can take as UNRID the signature of a public fixed message (e.g. empty), if the signature scheme is randomized and EUF-CMA secure. Verification simply checks the signature. If probability of collision among signatures is ...
Only top voted, non community-wiki answers of a minimum length are eligible
