4
Is any existing hash algorithm strong enough?
Yes; actually, any cryptographically secure hash algorithm (such as SHA-2, SHA-3, Blake2) would be plenty strong enough.
To emphasize this, let me point out that MD5 is strong enough. Now, MD5 is considered quite weak (and no one here would endorse its use); however even with its known weaknesses, it is still ...
3
The security of the signature schemes doesn't require the message to be encrypted. The hash algorithm and the signature algorithm parameters are publicly known and the only secret the signer's key must be kept secret all the time. The hashing before signing is part of the signature scheme since the first true signature scheme; Rabin Signature scheme.
In ...
2
Yes, it's normal practice to generate an ECDSA signature from message $M$ (or it's hash $H(M)$ ), private key $d_U$ and curve parameters, without being given a nonce as input. The nonce $k$ is built as part of the signing process, in one of two ways:
It's generated a secret integer $k$ uniformly in $[1,n)$ using a true random number generator with secret ...
2
There are two variants of ECDSA: randomized or deterministic. The calculation of a signature involves a number $k$ which must not ever be repeated for distinct messages with the same key. There are two ways to implement that: generating $k$ randomly, or generating $k$ in a deterministic way from the key and the message. (I am omitting details here, just ...
answered Jan 14 at 14:04
Gilles 'SO- stop being evil'
16k3 gold badges41 silver badges81 bronze badges
1
SHA-256 is resistant to preimage attacks. The only way to find a preimage that produces given hash is brute-forcing. Current computation resources used for bitcoin mining in the world compute about $2^{90}$ hashes per year. Thus, even if the whole world tries to create an image (in your case, to find particular padding) with the given hash, it will not be ...
1
It doesn't seem easy to protect from rearranging the pieces in a different order.
That depends; you haven't specified the operation to combine the hashes at this point.
Certainly any cryptographic hash function has a different value if it performs $H(x|y)$ instead of $H(y|x)$ where $x \neq y$ and the size of $x$ and $y$ are identical. If not, the collision ...
1
Your scheme has no forward secrecy. If an attacker obtains the server private key someday, all past sessions can be decrypted: Session keys can be decrypted and thus the corresponding sessions can be decrypted. See details here.
You scheme is prone to replay attack. If the attacker intercepts the traffic and knows the meaning of particular part of the ...
1
that key could be extracted and used to sign other data
Correct. An attacker can extract the key and sign anything.
Is it possible to verify that the output of an executable is the
direct result of its own unaltered (assembly) control flow?
Generally speaking, no.
It can be verified only in some specific cases. One approach can be to use signed executable ...
1
p=67 , q=11 , g=38 , H(m)=7 , x=6 (Is it correct to choose g=38?)
That's your problem; it is not correct to choose $g=38$.
$g$ has to be in the subgroup of order $q$, that is, it has to have order $q$. In this case, $g$ is a generator for a subgroup of order 6, that is, $g^6 = 1$.
Try again with a different $g$, for example, $g=9$.
Only top voted, non community-wiki answers of a minimum length are eligible