# Tag Info

3

This is a valid paradigm for building a signature scheme, although a secure commitment scheme should be used to commit to $k$ instead of just using $H(k)$ as the public key. This type of construction was published by Bellare and Goldwasser at CRYPTO'89; see New Paradigms for Digital Signatures and Message Authentication Based on Non-Interactive Zero ...

2

1024 and 768 refer to the dimension of the base "generator" matrix $A$, these numbers are multiples of 256, which is the size of the module ring. If the terminology is a bit confusing so far, then let me explain a little: $A$ is a component of the public key, it's computed from a random seed chosen during key generation. It's also used in signing ...

1

If you look at the key generation Prune the buffer: The lowest three bits of the first octet are cleared, the highest bit of the last octet is cleared, and the second highest bit of the last octet is set. This used to make sure that the key is not in the small groups, those have order 2,4, and 8. If you use $[8][S]B = [8]R + [8][k]A'$. then if the public ...

0

I can't believe it but I actually found an answer. The following js code does exactly the padding scheme as detailed in the EMSA-PKCS1-v1.5 message encoding specification function messageToEMSA_PKCS1_v1_5(message){ // https://tools.ietf.org/html/rfc3447#section-9.2 SHA256_DIGEST_INFO = "30" + "31" + "30" + "0d" ...

0

While the above answers are correct, I would like to add something that would have helped me, if I knew it before. A hash can always be computed by anyone. RSA goes a step further to use asymmetric encryption so that only the bearer of the private key is able to create valid signatures. The first versions of the algorithm had weaknesses (search for them, it ...

2

A QR code can hold a bit over 2kiB. That's plenty for a short letter and a signature. If more is needed, use more than one QR code, and number them for ease of use.

1

Let's begin with digital signatures; Digital Signature A digital signature scheme is simple the triple $Gen, Sign, Verify$ of polynomial-time algorithms. We want the $Gen$ and $Sign$ probabilistic and $Verify$ deterministic. The $Gen$ outputs public key $K_{pub}$ and private key $K_{prv}$ To sign a message $m$ compute $$\sigma = Sign^R(K_{prv}, m)$$ and ...

2

The correctness of the padding should be verifiable from the hash of the message - that is, given the hash of the message, the same padding should be reproducible. Otherwise, "existential forgery" would be possible. So what is "existential forgery"? Basically, you just produce a random string of bytes as your signature. When it's ...

3

A PFX file is better known as a PKCS#12, the "Personal Information Exchange Syntax". It is used either as a trusted certificate store or as a key store. When it is used as a (private) key store it generally contains entries with a private key and the certificate chain associated with it (leaf certificate, CA certificates and root certificate ...

2

How then does merely recovering $M$ from $S$, as described by the authors, prove that $D_B$ was applied to $M$ to produce $S$? It does not¹. As pointed in the question, $M$ could have been produced from a random $S$. Is legibility alone a strong enough proof of $M$ having been signed by $D_B$? No. It's easy to build counterexamples, for various plausible ...

Top 50 recent answers are included