9
I'll be assuming the question means Message Authentication Code (MAC) where it uses "Signature" and "Hash". MAC, signature and hash are three different things: MAC uses a secret for generation and verification, signature uses a secret for generation only, hash uses no secret.
Following comment, and most important: sending in clear a MAC ...
5
That's insecure.
In BLS signatures: for private key $x$ and public key $X = xP$, the signature is computed as $T = xS$, and the verification checks if $e(T, P) = e(S, X)$, which works because:
$e(T, P) = e(xS, P) = e(xS, P) = e(S, P)^x$
$e(S,X) = e(S, xP) = e(S, P)^x$
If you know that $S = kP$, then you can forge a signature for a message with hash $k'$ ...
3
I understand the question to mean: is there a function $F$ whose domain is signatures under a public-key signature scheme such that, given a signature $s_1$ made with a key $k_1$ and a signature $s_2$ made with a key $k_2$, $F(s_1) = f(s_2)$ if and only if $k_1 = k_2$? Or in simple terms: can you tell who made a signature by looking at it?
You aren't going ...
answered Sep 15 at 22:10
Gilles 'SO- stop being evil'
13.2k3 gold badges36 silver badges69 bronze badges
3
However, I do not know what length I need to have the signature at so when I encode it, it can be that exact size.
Well, base64 uses 4 characters (from an alphabet of size 64) to encode 3 bytes (3 bits contain 24 bits; 24/4 = 6 bits per base64 character).
Hence, if the signature was 72 bytes long, that would translate to 72/3*4 = 96 characters you require.
...
2
It is not possible if the signature scheme is secure, under the standard notion of "existential unforgeability under chosen message attacks". According to this definition, the adversary is given the public key and can then choose messages to be signed one after another. If it can forge any signature, then the scheme is not secure. As such, if the ...
2
The linked paper is not about Elliptic Curves which relies on additive groups. It is about the multiplicative groups. For both of them the discrete logarithm is defined. There are common notations that confuse people about them.
In the multiplicative version, the division is actually not a division like in the reals. It is the inverse in the group and ...
2
While it's technically not (probably) an issue, you should definitely avoid sharing keys between different purposes. RSA uses separate keys for signing and encryption, for example, since an encrypted-and-signed message would cancel out. RSA only signs a hash of the original message, negating this issue, but it still avoids sharing keys because it's simply ...
1
It depends on whether the pairing is a type 1 pairing or some other type of pairing. In a type 1 pairing, $S$ is a multiple of $P$. In any other type of pairing, $S$ is not a multiple of $P$.
1
I've always used it as #1. Hyperledger Ursa has an implementation in Rust
(see https://github.com/hyperledger/ursa/tree/master/libzmix/bbs).
However, it is a type of group signature which allows the type of signing of multiple messages.
When someone says to me group signature I immediately think your #2. If we look at a paper written by David Chaum (https://...
1
Is there a way to create a signature passing the above verification process that does not involve a square root in $\mathbb{F}_p$?
Well, one obvious thing to try is setting $R=0$ (the point at infinity); assuming the code doesn't have any protection against that (and the pseudocode doesn't), you compute $h = H_{c_2}(M || R_x || R_y )$ (where $R_x, R_y$ is ...
1
Can one extract a private key from a series of carefully constructed signed messages?
That should not happen, but has. One example is ISO/IEC 9796:1991 (description), which is the first (AFAIK) signature scheme vetted by an international standard body. It was shown (full disclosure: by me) vulnerable to recovery of the private key from the signature of two ...
Only top voted, non community-wiki answers of a minimum length are eligible
