4
It uses deterministic padding, i.e. padding with FF octets, finalized by a single 00 valued byte. So it is indeed RSASSA-PKCS1-v1_5 which uses EMSA-PKCS1-V1_5-ENCODE. Don't be fooled by the reference to RSA encryption in the OID for sha256WithRSAEncryption. That simply points to the modular exponentiation - in this case with the private key.
PKCS#1 versions ...
3
whether the checksum: 0xFFFF-SUM(N[i]) i=1...32 will solve the problem?
Yes, it does. That's exactly how both WOTS+ in XMSS and LM-OTS in LMS work
2
Libsodium is written/implementable in C++, C and Python. It implements lots of crypto systems, such as public key cryptography. Here is the intro in the docs: https://libsodium.gitbook.io/doc/
2
Is step #3 (verifying the EMSA-PKCS1-v1_5 padding) important to the security of the system?
Yes. That's paramount for small RSA public exponent $e$.
For $e\in\{3,5,7\}$, the easily computed integer $s=h^{(e^{-1}\bmod2^{254})}\bmod2^{256}$ is an acceptable signature for any message with an odd SHA-256 hash $h$ (that is about one message out of two). The ...
2
Should I always call the key used for verification "public key" even on those settings?
Usually it is a public key, or at least it is called that in the key pair generation procedure of the cryptosystem that is used. Public key is in that case a more generic term - it may not be decided for what the key will be used after all. Similarly, cryptographic API'...
1
If we use constant $k$ in this scheme we can find the secret key like this:
We know $(m_1,r_1,s_1)$ and $(m_2,r_2,s_2)$ for two different plaintext, as k is constant $r_1=r_2=r$ so we have this equivalence:
$$s_1k-m_1\equiv-ar\equiv s_1k-m_1\ mod\ p-1 \Rightarrow (s_1-s_2)k \equiv m_1-m_2\ mod\ p-1$$
This equivalence has $d$ answer where $d=gcd(s_1-s_2,p-1)...
1
Threshold signatures do not enforce accountability meaning a t-out-of-n threshold signature does not tell the verifier which $t$ of the $n$ signers created the signature. Multisignatures enforce accountability as the verifier learns which t signers created the signature. There does not need to be a threshold for multi-signatures.
But n-out-of-n threshold ...
1
I think Crypto++ will help you. This is a cryptography library implemented in C++. Its homepage: Crypto++ Library.
1
What you need is a digital signature algorithm. Public key cryptography means that you have a public and private key. The server can sign a message by performing some maths on it using his private key. All the clients, who know the servers public key, can then do some maths to verify the signature using the servers public key, proving the authenticity.
...
1
Yes, this is a way to establish authenticity through the use of a so-called "shared secret".
In practice you could do it using the HMAC algorithm and a shared key between the server and clients.
Notice that here, there is a problem with shared keys: that is that the whole system is not secure as soon as one client is breached.
There are also other ways to ...
1
Curve 25519 (X25519, Ed25519) Convert coordinates between Montgomery curve and twisted Edwards curve
Note you're doing direct division instead of modular inverse.
Since there is no division in elliptic curve arithmetic, you need to do mod inverse. pow function could be used as a helper here; it takes third argument as modulus:
>>> P = 2 ** 255 - 19
>>> X = 15112221349535400772501151409588531511454012693041857206046113283949847762202
>&...
Only top voted, non community-wiki answers of a minimum length are eligible
