30
What you seem to be looking for is deniable authentication.
This is actually a somewhat stronger property than what you're asking for: it guarantees that the recipient (let's call him Bob) cannot cryptographically convince anyone else that the sender (let's call her Alice) signed the message, even if he discloses all his private keys, simply because the ...
12
Lets say Alice wants to send Bob a sensitive message, she wants to prove to Bob that it came from her, but she doesn't want Bob to be able to prove that to anyone else.
A MAC is a good way of doing this. If Alice and Bob share a MAC key (and only they have it) then Bob will know any message authenticated with that MAC key came from Alice, since he knows he ...
4
This was discussed by Coron in 1.
You are actually asking why the random oracle can't just be some uncontrollable ideal random oracle.
In fact Bellare and Rogaway when introduced their Full Domain Hash scheme (FDH) in the seminal works 2,3 used this uncontrollable random oracle to analyze the security reduction for FDH.
The thing about using reductions ...
3
Don't use SHA-1.
There's unlikely to be a substantive difference between the other choices, as far as you're concerned, except performance:
SHA-256 is might be cheaper on 32-bit CPUs; SHA-384 and SHA-512 are cheaper on 64-bit CPUs.
NIST P-256 is likely to be cheaper than NIST P-384 which is likely to be cheaper than NIST P-521.
All of these choices ...
2
This diagram is not accurate. Hashing is not a separate step outside signing for the convenience of handling long messages; hashing is an integral part of signing that is necessary for security. And the verification algorithm does not always return a hash that you can compute separately: it only returns a boolean that indicates a valid signature or not. ...
2
In general case, $k^{-1}$ is equal to $x$ such that $x \cdot k=1$. In your question, to computing $11^{-1}$, you must find $x$ such that $x\cdot11=1 \pmod {8368}$. You can compute $x$ by using the extended Euclidean algorithm.
2
Suppose a signature is not an integer $s$ such that $s^e \equiv H(m) \pmod N$, but rather a pair of integers $(s, k)$ with $s < N$ and $k < N^{e - 1}$ such that $$s^e = H(m) + kN.$$ Then the verifier can verify this equation modulo a secret uniform random $v$-bit prime $r$, $$s^e \equiv H(m) + kN \pmod r.$$ There are $\pi(2^v) - \pi(2^{v-1})$ such ...
2
(This is to complement Avilan's answer on a more philosophical level.)
In the random-oracle model (ROM for short) [BR], all parties are assumed to have oracle-access to a public random function $H$. The security of a protocol is then argued relative to this random oracle $H$, and then in practice $H$ is instantiated by an appropriate hash function (say, ...
1
Suppose you have a forgery procedure which takes a public key, calls SHA-256, interacts with an automatic PGP mail system, does some horrible computation, and returns an attempted forgery:
import hashlib
import smtplib
def forge(pubkey):
... hashlib.sha256(m0) ... smtplib.sendmail(m1) ...
return (forged_msg, forged_sig)
We can take the text of ...
1
The words "controls"(in the question) and "manipulates"(in the paper) can be somehow misleading as to what is happening. Often in literature this is rather formulated as: emulates a random oracle, etc...
One could quote the paper(with modifications) as follows:
Given a forger $\mathcal{F}$ for the $GDH$ group $G$, we build an algorithm $\mathcal{A}$ that ...
1
If $l<k$, then the attack will be detected with a probability 1.
If $l\ge k$, the probability of the attack not being detected is
$$\frac{l}{n}\cdot \frac{l-1}{n-1}\cdots \frac{l-k+1}{n-k+1}\ge (\frac{l-k+1}{n-k+1})^k$$
Whether this is large enough or not depends on $n,k,l$.
If the attacker does not know $k$, the best he can do is to choose $l=n-1$, ...
1
This problem is well defined for supply chain management, and generally you use a challenge-response. In RFID, you an use asymmetric or symmetric schemes to verify that a product is authentic. I give RFID as an example because you should be able find a lot of documentation on them.
In the asymmetric case:
A authentic product public key is on the ...
Only top voted, non community-wiki answers of a minimum length are eligible
