4
In my opinion this may open door to a lot of attacks the attacker can use.
Actually, public key signatures are designed to be used securely like this. When we design a signature method, we assume that the attacker can ask for a large number of messages of his choosing to be signed, and still try to ensure that the attacker cannot generate a valid signature ...
3
In elliptic curve cryptography, the main operation is point multiplication: given an integer $k$ and a point $P$, compute $kP$ ($P$ added to itself $k$ times).
If the point $P$ is known beforehand, the computation can be sped up by using precomputation tables.
EdDSA signing requires computing $rB$ where $B$ is a fixed point (the "base"), therefore can be ...
2
How is this avoided??
Well, if it add any sort of integrity check to the data (be it a signature or a more sensible MAC), well, that increases the size of the data (packet), and so can potentially push the packet to be larger than the MTU size (assuming the inbound and outbound MTU sizes are the same).
However, the TCP/IP protocol has mechanisms to deal ...
2
Active Authentication (AA henceforth) relies on RSA or ECDSA and allows you to sign data. However, as our is not meant to sign data you should not use it for that purpose.
First of all, the only PKI that verifies the public key is that used for passive authentication of the passport - so you probably have to set up a separate PKI for it to be useful. ...
1
If your email is indeed in the cert and the key usage is there, you would expect that you can sign with it, providing that:
the certificate is compatible with the email client;
the signing generation is compatible with the email client;
that you have the entire certificate chain present (otherwise the receiver may miss an intermediate certificate).
And of ...
1
I do not have access to the paper you have linked, but I certanly can answer the first question and maybe answer the third question:
$(\hat{u}, \hat{v}) \in G_2^2$ is a short version of $(\hat{u}, \hat{v}) \in (G_2 \times G_2)$ which is a short version of "$\hat{u} \in G_2$ and $\hat{v} \in G_2$".
Since I don't have access to the paper I'm gonna make some ...
1
Yes, in the random oracle model, the hash of a BLS signature makes a VRF essentially as secure as the BLS signature scheme (provided the verifier accepts only the unique canonical encoding of each signature).
This works because BLS signatures are unique. Fix a pairing $e\colon G_1 \times G_2 \to G_T$ on groups $G_1$ and $G_2$ of prime order. For any fixed ...
Only top voted, non community-wiki answers of a minimum length are eligible
