6
Is it legit?
No, and you hit on the reason - the algorithm converts the message into a series of 16 values from 1 to 128, and then signs based only on that. That's a total of 112 bits; actually, it's somewhat worse than that, as the algorithm they use to convert the message hash into the series of 16 values will generate values that always sum (mod 128) to ...
5
So, I’m wondering how much data can be verified by an electric signature?
If you're asking about how much data that a single public key signature can handle, well, there's no realistic limit.
What every signature system (at least, every one that I've heard of) does is take the message, pass it through a hash function to generate a short hash (and then ...
5
In public-key cryptography, there is NO SUCH THING as "encrypt with private key". It's a misnomer since the RSA days.
Also, what you describe as "M = function(pubkey, signature)" is signature with message recovery. These algorithms are rare nowadays and had been largely replaced with signature with appendix (which ECDSA is one of them).
...
4
The specification mentions that the signature is per ECDSA on curve "P-256" (aka secp256r1), or RSASSA-PSS with a modulus of 2048 bits in combination with the SHA–256 hash (I guess with MGF1 with SHA-256; can't be sure for salt size). These are state-of-the-art, unbroken algorithms.
I find it unbelievable that a cryptographic attack would let emit ...
1
Your certificate contains a public key, the P-256 or secp256r1 or prime256v1 you can see here. However, the key is in uncompressed format (starting with a byte 04 and then 64 random looking bytes) and the domain parameters are specified using an OID with the curve mentioned above. So the only coordinates are those of the public key, and those are always the ...
1
You actually need a family of second-preimage resistant, undetectable, one-way functions. In general, any secure cryptographic hash function (SHA2, SHA3, ...) should work with a little tweak to make it keyed. You do not need it to be a PRF, and the function is fixed length. Hence, if you also fix the key length, using
SHA3(K || M)
is fine (and then taking ...
1
The height of the merkle tree is an independent parameter. The Winternitz parameter — $w$ — comes up because to sign or verify a WOTS+ signature the first step is to encode your message as a list of integers from $0$ to $w - 1$ (inclusive). For example the string "hello" is encoded in ascii as 01101000 01100101 01101100 01101100 01101111. If $w$ ...
Only top voted, non community-wiki answers of a minimum length are eligible
