212

These types of cryptographic primitive can be distinguished by the security goals they fulfill (in the simple protocol of "appending to a message"): Integrity: Can the recipient be confident that the message has not been accidentally modified? Authentication: Can the recipient be confident that the message originates from the sender? Non-repudiation: If the ...


89

Assuming you are asking about public-key signatures + public-key encryption: Short answer: I recommend sign-then-encrypt, but prepend the recipient's name to the message first. Long answer: When Alice wants to send an authenticated message to Bob, she should sign and encrypt the message. In particular, she prepends Bob's name to the message, signs this ...


87

Why is it common practice to create a hash of the message and sign that instead of signing the message directly? Well, the RSA operation can't handle messages longer than the modulus size. That means that if you have a 2048 bit RSA key, you would be unable to directly sign any messages longer than 256 bytes long (and even that would have problems, because ...


58

Draft paper linked from efail.de. TL;DR: the vulnerability is in some popular email client software, often combined with an extension simplifying the use of an OpenPGP (e.g. GnuPG) or S/MIME implementation within the said software; e.g. an extension bundled in popular distributions of GnuPG v2, thus common. The issue is that un-validated deciphered ...


51

From a cryptographic standpoint it is OK to expose a public key in the sense of revealing its value. The most basic assumption in cryptography involving public/private key pairs is that the value of a public key is public; hence its name. It is extremely important that an adversary can not alter a public key. Any exposition that would allow alteration must ...


50

There are a few parts to the EFAIL attacks. Some parts are the fault of the mailer authors for exposing unnecessary attack surface via arbitrary incoming email. Some parts are the fault of the OpenPGP and S/MIME designers for failing to heed modern cryptography engineering principles—in particular, failing to provide NM-CPA public-key encryption. For ...


32

The short answer is no. This is a general piece of wisdom in cryptography: never use the same key for more than one thing. A “thing” means a specific scheme where all the parameters are fixed apart from the key itself and the message size. Don't use the same key to encrypt and sign; don't use the same key with both PKCS#1v1.5 and PSS; don't use the same key ...


32

What you seem to be looking for is deniable authentication. This is actually a somewhat stronger property than what you're asking for: it guarantees that the recipient (let's call him Bob) cannot cryptographically convince anyone else that the sender (let's call her Alice) signed the message, even if he discloses all his private keys, simply because the ...


31

In addition to the performance problems poncho already mentioned when using RSA signatures without hashing I just want to add on the security warning of poncho: Reordering If you have a message $m>N$ with $N$ being the RSA modulus, then you have to perform at least 2 RSA signatures as $m$ does not longer fit into $Z_N$. Let us assume that it requires $k$ ...


28

Short answer No, RSA encryption with a private key is not the same as RSA signature generation. RSA encryption can only be performed with an RSA public key according to the RSA standard. The terms Raw RSA or textbook RSA are often used to indicate RSA without a padding scheme. Raw RSA simply consists of modular exponentiation. Raw RSA is vulnerable to many ...


20

It is possible to view DSA/ECDSA as an identification scheme (like Schnorr) but with a different variant of Fiat-Shamir. This gives the intuition that you are perhaps looking for. I will include an excerpt from Intro to Modern Cryptography 2nd edition (Section 12.5.2) which gives this explanation: Begin Excerpt -- Section 12.5.2 DSA and ECDSA The Digital ...


20

Indeed the text quoted is wrong; at the very least, by using incorrect vocabulary. That should be: if you sign a message with your private key, the paired public key can be used to verify the signed message's integrity and origin. What small amount of truth there is in the original statement boils down to: in some asymmetric cryptosystems, including RSA¹ (...


19

The RFC specifies things in terms of bits. Each call to HMAC outputs hlen bits. tlen is the count of bits obtained so far; when at least qlen bits have been obtained, this step is finished. The sample code is written in Java in which the elementary unit of information is the octet ("byte" in usual terminology). The supported hash functions always output a ...


18

PKCS#1, "the" RSA standard, describes how a signature should be encoded, and it is a sequence of bytes with big-endian unsigned encoding, always of the size of the modulus. This means that for a 2048-bit modulus, all signatures have length exactly 256 bytes, never more, never less. PKCS#1 is the most widely used standard, but there are other standards in ...


17

Take a look at FIPS 140-2 Annex A. It lists the following: Symmetric Key AES, Triple-DES, Escrowed Encryption Standard Asymmetric Key DSA, RSA, ECDSA Hash Standards SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256 Random number generators See annex c Message authentication CCM, GCM, GMAC, CMAC, HMAC


17

If this requires a single answer among 1/2/3/4 (rather than none), I would select 3, by the following reasoning: Digital Signature provides confidentiality while message authentication code can not We can summarily exclude this, since a Digital Signature simply does not provide confidentiality. Digital Signatures works faster than message ...


17

First of all, yes, the message digest is the hash of the message. Secondly, do not mix things up. You are talking about public key encryption and signature. Let's redefine them to make sure we have everything right. Alice and Bob got pairs of key ($A_{pub}$, $A_{priv}$), ($B_{pub}$, $B_{priv}$). Alice knows $B_{pub}$ and Bob knows $A_{pub}$. Alice wants ...


17

This is one of the earliest questions that was asked in modern cryptography. There is a proof that you cannot achieve completely fair contract signing. However, there are some reasonable alternatives. There is one direction called "gradual release" which I personally do not like. A model that I think has a lot of promise is called the "optimistic model". In ...


16

Digital signatures are not designed for confidentiality. For the simplest counterexample to the implicit conclusion that there is no point to digital signatures without confidentiality, consider the use of PGP signatures. People may sign a message that they send to a public mailing list, allowing others to verify that they indeed said that and not an ...


15

I hope I got your point and try to answer your question. Actually, if I understand you right, then what you call an attack actually means an adversary acting in a specific attack model. To clarify this, we need to review the security models for digital signature schemes and when we have discussed this we can clarify issues. Basically, we have to discuss ...


15

You use your private key for "encryption". That's a common misconception, which has roots in history. The point is that for RSA calculations the signature generation operation uses the same mathematical operation - modular exponentiation - with the private key as the encryption operation with the public key. So in older versions of PKCS#1 - itself called "...


15

The main reason is historical (and a bit sad). ECDSA can be seen as a repurposed authentication mechanism. The private key owner wants to prove knowledge of the private key $x$ that matches a given public key $Q = xG$, but without revealing that private key. Thus, this is organized as a three-step protocol: The prover makes a commitment on a newly ...


15

It is easy to construct a signature scheme that is existentially unforgeable but not strong. All you have to do is add a bit to the end of a strong scheme, and ignore it upon verification. This enables an attacker to flip a bit and have the new signature accepted. In some "real" settings this arises as well. For example, with ECDSA, a signature $(r,s)$ can ...


14

If you can store the private key with some pre-computed work, then you can pick almost any public key you want. So in a way, it depends on the implementation. Here's a diagram of how Ed25519 works, note how keys are generated: (Image source.) A more detailed description (that is simpler than the actual paper) of the process is in these slides (slides 9 - ...


14

An RSA signature is a sequence of bytes of the same size of the modulus. If the key uses a 1024-bit modulus $n$, then the signature value is, numerically, an integer in the $1..n-1$ range, and the PKCS#1 standard specifies that this integer should be encoded as a sequence of bytes of the same length as would be needed to encode the modulus, i.e. 128 bytes ...


14

Well, one reason to hash the data before signing it is because RSA can handle only so much data; we might want to sign messages longer than that. For example, suppose we are using a 2k RSA key; that means that the RSA operation can handle messages up to 2047 bits; or 255 bytes. We often want to sign messages longer than 255 bytes. By hashing the message ...


14

This is standard mathematical notation and not specific to cryptography. The $\Pi$ symbol means Product in much the same sense $\Sigma$ means Sum. For instance, $$\prod_{i=0}^2{u_i^{m_i}} = u_0^{m_0}u_1^{m_1}u_2^{m_2}$$


14

SafeCurves lists some ways to compare the security of elliptic curves. Their security criteria are split to "ECDLP security" and "ECC security". Failing the former basically means "there is no way to use this curve securely in general" while the latter "it is difficult to implement this curve securely". None of the (few) BouncyCastle-supported curves that ...


14

The advent of quantum computing, real usable out of the lab QC, will pretty much be the end of any encryption that relies on the difficulty of the discrete log problem via Shor's Algorithm et al. That is not to say it is the death of all modulus based encryption schemes, probably just asymmetric public/private key based schemes. That said, QC's aren't magic,...


Only top voted, non community-wiki answers of a minimum length are eligible