55

Encrypt your document, and embed a web address (and login details) in the packaging from which a reader can get the decryption key. The website must be trusted. The website logs will tell you when software has requested the key to decrypt it. If you also want to protect confidentiality, encrypt with two keys. One is the usual private key used to protect ...


22

With classical information, there is no way as you correctly surmise: someone could always duplicate the data. However with quantum information there is a no-cloning theorem. With quantum information it is possible to bound the amount of information that has been extracted from a system based on the fidelity of the system. This gives the concept of tamper ...


20

Indeed the text quoted is wrong; at the very least, by using incorrect vocabulary. That should be: if you sign a message with your private key, the paired public key can be used to verify the signed message's integrity and origin. What small amount of truth there is in the original statement boils down to: in some asymmetric cryptosystems, including RSA¹ (...


13

Not with a file, as you say in your question You can always take a bitwise copy of a file. Always. Even if some specific OS makes it inconvenient, you can change to an OS which does let you. This leaves you with two possibilities for confirming opening. The file is encrypted in some way which requires you to access an external website to get the key, and ...


9

I'll be assuming the question means Message Authentication Code (MAC) where it uses "Signature" and "Hash". MAC, signature and hash are three different things: MAC uses a secret for generation and verification, signature uses a secret for generation only, hash uses no secret. Following comment, and most important: sending in clear a MAC ...


6

That's insecure. In BLS signatures: for private key $x$ and public key $X = xP$, the signature is computed as $T = xS$, and the verification checks if $e(T, P) = e(S, X)$, which works because: $e(T, P) = e(xS, P) = e(xS, P) = e(S, P)^x$ $e(S,X) = e(S, xP) = e(S, P)^x$ If you know that $S = kP$, then you can forge a signature for a message with hash $k'$ ...


6

Yes, there is an important one; The Non-Reputation; Non-repudiation refers to a situation where a statement's author cannot successfully dispute its authorship or the validity of an associated contract The HMAC key is a symmetric key therefore there is no non-repudiation. Both sides can not claim that the other side sends them the message $m$. I.e. They ...


6

Slightly tongue-in-cheek answer, but why not put the document on a usb key, then put the usb key in a box and wrap it with the tamper evident physical seals you pictured. That way the document is secure (inside the box) and people will know if anyone has attempted to read the data (because of the physical seals you have to break to get at the usb key).


5

You misunderstood something. HMAC-SHA-1 does not use SHA-1 as the signing algorithm. The signing algorithm is the HMAC-SHA-1 calculation, not an intermediate SHA-1 calculation. The signing algorithm takes the key and the message as inputs and produces the MAC value as output. The usual terminology for the hash algorithm that an HMAC construction uses is “...


5

I am not sure how the IND-CCA experiment in this case works. Well, it doesn't really. There are no verification keys designated as such in the CCA experiment and there is no designated sender in the definition of a public key encryption scheme at all. So, the only way to communicate to the receiver who supposedly encrypted a ciphertext would be to put it in ...


5

I was expecting that the signature verification will be faster than the signature generation Because signature verification is faster in RSA? Well, as you can see, RSA != ECDSA; the operations involved in both signing and verification are completely different. what makes the signature generation faster ? Because signature generation involves only one ...


5

EdDSA is not ECDSA over a different curve. Rather, it is a type of Schnorr signature. Indeed the name is very confusing, and I'm pretty sure that it was chosen in order to give this impression, since Schnorr is less well known. Schnorr is essentially a zero-knowledge proof of knowledge of the discrete log of the public key, obtained via the Fiat-Shamir ...


5

We want $(r,s)$ same for two different set of $d,k,h$ In ECDSA $r = x_0([k]G) \bmod n$ where $k \in [1,n-1]$ and $x_o$ is the x-coordinate of the scalar multiplication $[k]G$ $s = k^{-1}\cdot (h+r\cdot d)$ where $h$ is the left most bits of $h$ to fit in the group order ( for simplicity we called it $h$ again). Now we want same $(r,s)$ for $d,k,h$ and $d',...


5

The proposed digital signature scheme is not secure! More precisely, it is not existentially unforgeable under an adaptive chosen-message attack. Let's consider the following efficient adversary $\mathcal{A}$: it queries the $\mathsf{Sign}_{sk}(\cdot)$ oracle for the digital signatures on $m_1,m_2$, where $m_2:=m_1+1$. The received signatures are $\sigma_1=...


4

Is there a signature scheme in which $\text{signature} = \mathsf{Sign}(\text{message} \mathbin\| \text{signature})$ ? With standard RSA signatures (RSASSA-PKCS1-v1_5, RSASSA-PSS of PKCS#1), that's possible if one chooses the public/private key pair for that purpose, as a function of the message. On top of that one can even make the signature nearly anything ...


4

As pointed out by @SEJPM, you can read more about security proofs for DSA/ECDSA family on this thread. As for whether there exists an interactive protocol corresponding to DSA/ECDSA à la Schnorr identification/Schnorr signature, not that I am aware of. I would add that this is unlikely for two reasons: The (unfortunate) reason for coming up with DSA/ECDSA ...


4

I am wondering, why I cannot use a plain one-time signature mechanism to sign an unlimited sequence of messages You can; your method does exactly that. However, it assumes that the verifier sees all previous signatures before verifying the next - not all use cases can assume that.


4

The first thing to clarify is the definition of “EdDSA”. EdDSA was introduced in Bernstein et al.'s High-speed high-security signatures in 2011. Various parameters it implicitly assumed were declared more generally in the 2015 paper Bernstein et al., EdDSA for more curves. This culminated in an RFC Edwards-Curve Digital Signature Algorithm (EdDSA), RFC 8032 ...


4

bob hashes his message and encrypt it with alice public key No, Bob would sign it with his own private key. For some signature methods, this is roughly similar to "encrypting with the private key", however for other signature methods, it's not; hence it is safer to keep a strong distinction between 'signing' and 'encrypting' alice receives the ...


4

Signatures provide one property that MACs don't: non-repudiation. With only a MAC (or an AEAD) any party with the secret key could have sent the message. So Bob could forge a message and claim Alice sent it. With a signature only the party holding the corresponding private key could have created the signature. MACs authenticate the message, not the sender. ...


4

What you are sharing is indeed (lapo.it ASN.1 decoder) a 1023 bit public RSA key. RSA keys can be used for multiple things such as signature generation. In that case the signature algorithm may use SHA-256 to hash the message, but the key itself doesn't care about the hash function used (you won't see it in the structure in the link). "private/public ...


4

Most video formats generate periodic key frames where the entire picture is rendered and then specify subsequent frames which are differences from the previous image. This is beneficial because this dramatically reduces the amount of data that needs to be transmitted, while still allowing periodic seeking. It would be possible to embed a cryptographic ...


4

I'll choose a more generic approach which can be applied even to non-digital. Minor note, I can re-tape the package from your photo or reproduce my copy of the seal. It's a matter of how well made it has to be to fool you. The premise here is to have a way to do something (digitally) and preserve a state of it. However, for that to not be tampered with you ...


4

For a given private key $d$, random $k$ and message hash $h$: is it possible that there exists a different set of $d$, $k$ and $h$ which produces the same ECDSA signature using the $\text{secp256k1}$ curve? Yes, and further it's easy to explicitly compute an alternate $(d',k',h')$ that matches all reasonable meanings of "different set of $d$, $k$ and $...


3

Yes, the server reconstructs the signature pre-image and then verifies that the signature is valid. From a purely protocol perspective, I think you effectively answered your own question - the protocol defines the format with which the signature is sent to the server and it doesn't contain the session identifier. On page 1 it mentions: When this protocol ...


3

While this could be misleading, it is ultimately serving the same purpose here, just with a symmetric key instead of an asymmetric one. Just as an asymmetric signature provides proof of ownership of the private key, a MAC provides proof of ownership of the symmetric key. Depending on how this key comes into existence this may provide varying levels of real-...


3

The thing that makes subtle crypto almost entirely useless is the lack of key management. Although you seem to use the primitives in the correct way, the key management is not specified at all in your question. If, for instance, you cannot trust the TLS connection, then what chance is there that the public key used for encryption is trusted? About none. ...


3

However, I do not know what length I need to have the signature at so when I encode it, it can be that exact size. Well, base64 uses 4 characters (from an alphabet of size 64) to encode 3 bytes (3 bits contain 24 bits; 24/4 = 6 bits per base64 character). Hence, if the signature was 72 bytes long, that would translate to 72/3*4 = 96 characters you require. ...


3

I understand the question to mean: is there a function $F$ whose domain is signatures under a public-key signature scheme such that, given a signature $s_1$ made with a key $k_1$ and a signature $s_2$ made with a key $k_2$, $F(s_1) = f(s_2)$ if and only if $k_1 = k_2$? Or in simple terms: can you tell who made a signature by looking at it? You aren't going ...


3

A PFX file is better known as a PKCS#12, the "Personal Information Exchange Syntax". It is used either as a trusted certificate store or as a key store. When it is used as a (private) key store it generally contains entries with a private key and the certificate chain associated with it (leaf certificate, CA certificates and root certificate ...


Only top voted, non community-wiki answers of a minimum length are eligible