New answers tagged

0

The 3 properties have commonly accepted meaning in Cryptography: Authenticity: The message comes from the party associated with the verification key. Integrity: The message had not been modified. Non-repudiation: The signer cannot deny themselves signing the message. We usually model the security against the weakest point of the signature/MAC - being ...


1

Among errors: In proper DSA, $s=\left({k_E}^{-1}\right)\,\left(h(x)+d\,r\right)\bmod q$, not $s=\left(h(x)+d\,r\right)\,α\bmod p$ as in the question.That computation (including the missing modular inverse) must be performed $\bmod q$; and $α$ is unwanted. That's mostly what prevents some examples from working. In proper DSA, $r=\left(α^{k_E}\bmod p\right)\...


1

Keeping your notation, signature generation in DSA is the following: $r = (\alpha^{kE} \bmod p) \bmod q$ $s = kEinv \times (h(x) + d\times r) \bmod q$ where $kEinv$ is the modular inverse of $kE$ modulo $q$. But you actually did was using the formula $s= (h(x)+d\times r) \times \alpha \bmod q$, and you forgot to reduce $r$ modulo $q$. You can take a look ...


2

How does reducing the upper limit for $k$ (to $2^n$) improve an attacker's chances to learn $k$ Security becomes at most $n/2$-bit. Baby step - giant step finds $k$ given the public key $\underline{[k]G}$ with computational cost $\mathcal O(2^{n/2})$. Pollard's Rho can be adapted to the same asymptotic cost, with feasibly little memory and efficient ...


4

It is not possible: Let $d_A, d_B$ be distinct private keys. Then $$ s=k^{-1}(z+rd_A)=k^{-1}((z+r\;(d_A-d_B)) + rd_B) $$ So the pair $(r, s)$ is not only a valid signature for the public key $d_AG$ and the (partial) hash $z$, but also for the public key $d_BG$ and the message hash $z+r\,(d_A-d_B) \pmod n$. So in many cases (if there are no restrictions ...


0

"My question is if there is a fast way of determining whether P exists, without doing the full expensive calculations to determine P." I believe that you could check whether $r$ is a valid nonzero $x$ coordinate; that is, whether it is a part of a solution to curve equation (e.g. if your curve is in Weierstrass form with characteristic > 3, you'd check ...


0

The standard RSA ($c=m^{e}$ $mod(n)$) is not semantically secure, since it reveals one bit information about the message. This information is jacobi symbol of the message. You can find many resources about jacobi symbol but basically it states that a value is in $QR_n$ or not. In CL signature, we can handle with this situation easilly, since we determine the ...


19

The RFC specifies things in terms of bits. Each call to HMAC outputs hlen bits. tlen is the count of bits obtained so far; when at least qlen bits have been obtained, this step is finished. The sample code is written in Java in which the elementary unit of information is the octet ("byte" in usual terminology). The supported hash functions always output a ...


3

Is there a reason for these differences You do realize that ECDSA is randomized [1], that is, signing the same message twice with the same private key will generate two different signatures. This is normal, and not due to you using three different ECDSA implementations. All three signatures are DER-encodings of 'a list of two integers, both of which are ...


1

Encryption/Decryption and Signing/Verifying satisfies two different aspects of the information security triad. Refer to the CIA triad for more information. Encryption/Decryption ( Confidentiality) Encryption makes sure that the content of a message we send through an unprotected medium, stays unknown, even though it falls into the wrong hands. Thus ...


1

So I was wondering, is there any difference between "Encrypting + Decrypting" and "Signing + Verifying"? I mean, if I hash the message and then encrypt it, wouldn't that be the same as Signing it? First of all RSA or any public key is not preferred for encryption, we prefer a hybrid-cryptosystem where a key is transferred/exchanged with public-key ...


Top 50 recent answers are included