5
In practice, in order to pick a uniformly random $x\in \mathbb{Z}^*_q$, we reduce that task to the problem of picking uniformly random and independent bits. On a modern computer system, there will be some operating system service supplying such bits, e.g. /dev/urandom on many Unix derivatives (we'll get back to the problem of how such bits have been obtained ...
3
In general, how do e2e messaging platforms deal with changes to the structure of the encrypted data?
This is the generic IT problem of backward compatibility, made harder by crypto.
In IT, a common way to deal with backward compatibility is having a version field at start of data structures, allowing applications to decide if they recognize the format, and handle it if they can. New applications handle old formats, at least during a transition period. This ...
2
Is this a reasonable idea?
Sounds good, as long as:
You use a strong RSA key (e.g. at least 2048 bits)
You use a good RSA signature padding method
You somehow prevent the attacker from modifying the RSA public key you use to verify with
Does the low-entropy data cause problems?
No, the low-entropy data does not present a problem.
How many of these ...
2
The first seminal paper to define the terms Chosen Message Attack (CMA) and existential forgery (the opposite of which is SUF and WUF) is A digital signature scheme secure against adaptive chosen-message attacks by S. Goldwasser, S. Micali, and R. L. Rivest. But the best paper to formally define SUF-CMA and WUF-CMA in the form of a game is Authenticated ...
2
If its the hashed one, where you hash the message before signing it, cant an attacker still generate valid signatures where he computes: (message,signature):( hash(m)^e , hash(m) ) and it is a valid signature?
Actually, $hash(m)$ is extremely unlikely to be a valid signature for anything. When TLS uses RSA to sign, what we do is hash the transcript (that ...
2
A digital signature makes use of two keys a private key that can be used for producing signatures and a public key that can be used for verification of signatures. The certificate contains information that ties the identity of the signer to the public (verification) key but does not allow anyone to deduce the private (signing) key.
Anyone can present a ...
2
Hoping to satisfy @fgrieu invite in comments, I try an answer coming from Monero's implementation. The source of these words is the cheatsheet I have written https://getmonero.org/library/RingsCheatsheet20210301.pdf while studying https://www.getmonero.org/library/Zero-to-Monero-2-0-0.pdf
I think the right thing is to start from non-interactive (in the Fiat-...
2
All these post quantum signature schemes are claimed by the authors to be naturally resistant to side channel attacks. My question is, why or how?
Well, lets break this down:
In terms of timing and cache-based side channels, the obvious implementation is fairly good (exception: the Haraka-based parameter sets of Sphincs+)
Here's why: the natural ...
Only top voted, non community-wiki answers of a minimum length are eligible