New answers tagged

0

A digital storage device that includes a serial number and 'read' counter. Create your document. Store it on the device. Note the SN and read count. If the next person reads the document and the read count is not prior + 1, then they know that it has been viewed.


0

I know the Word documents, Excel spreadsheets, and PDF files have mechanisms from executing some code when opened. You could create a routine that calls a URL when opened, and that URL would just be a tracker that logs the number of times the document is opened. There are vulnerabilities. The document needs to have web access when opened. You could have the ...


2

It is totally possible and fairly easy to see without any advanced maths. The curve has order n (n Points in the curve) the private key d is [0... n-1] and the random number k [1... n-1] and there are 2^256 possible values for h. So there are n*(n-1)*2^256 possible inputs (d, k, h combinations). The output is r, s. Where r is there x part of a point so there ...


5

The proposed digital signature scheme is not secure! More precisely, it is not existentially unforgeable under an adaptive chosen-message attack. Let's consider the following efficient adversary $\mathcal{A}$: it queries the $\mathsf{Sign}_{sk}(\cdot)$ oracle for the digital signatures on $m_1,m_2$, where $m_2:=m_1+1$. The received signatures are $\sigma_1=...


4

For a given private key $d$, random $k$ and message hash $h$: is it possible that there exists a different set of $d$, $k$ and $h$ which produces the same ECDSA signature using the $\text{secp256k1}$ curve? Yes, and further it's easy to explicitly compute an alternate $(d',k',h')$ that matches all reasonable meanings of "different set of $d$, $k$ and $...


5

We want $(r,s)$ same for two different set of $d,k,h$ In ECDSA $r = x_0([k]G) \bmod n$ where $k \in [1,n-1]$ and $x_o$ is the x-coordinate of the scalar multiplication $[k]G$ $s = k^{-1}\cdot (h+r\cdot d)$ where $h$ is the left most bits of $h$ to fit in the group order ( for simplicity we called it $h$ again). Now we want same $(r,s)$ for $d,k,h$ and $d',...


0

Version control is really the only solution to this as the document would need to be managed. I would have to say version control over a document is really the only real way to track changes to a file and be able to work off one instance of the document. The reason this is the case is that you need to track state of a document not content. Anything outside ...


1

I'm still piecing things together, so bear with me as this may be revised. Access to a signature oracle is either a zero-knowledge resource or breaks the random oracle model for $H_k$. To see this we observe that anyone can generate valid $(m,s)$ pairs for random values of $H_k$. They do this by picking arbitrary $s$ in the required range, squaring to get a ...


0

This answers my own Q1 and Q3. Q2 still flies above my head, but getting closer. Q1 asked an argument why it can't help factoring $n$ that by examining Rabin-Williams signatures for known or chosen messages $M$, an adversary can find loads of pseudo-random $m=16\,H_k(M)+12$ with known $\left(\frac m p\right)$ and $\left(\frac m q\right)$; when for a given $m$...


0

Proposition: the signature consists of the message $M$ and a standard signature $S$ of $M$ as an appendix, e.g. $S$ is per Ed25519. This allows to verify any subset of $M$ (by checking the subset of $M$ against the full $M$, and the full $M$ against it's signature $S$). This proposal reveals $M$, but that's unavoidable: if one can verify any subset of $M$, ...


2

We can easily see that the signature must be at least as large as the message. Otherwise, it would be impossible to verify any arbitrary single bit. Signing a message with n bits must necessarily must involve a signature that can validate n unrelated 1 bit message subsets. However, if we assume Bob and Mallory are given copies of the message, there may be ...


2

I had emailed Dr Thomas Pornin the very same question and received his reply. With his permission I cross post his answer as followed From: "Thomas Pornin" ... Date: 2021/04/22 11:38 Q1: Additional data k' is concatenated after bits2octets(H(m)) in HMAC input in step d. May we also need to concatenate k' after bits2octets(H(m)) in HMAC input in ...


1

The XMSS tree is constructed using the W-OTS keys. Each leaf of the XMSS tree corresponds to a distinct W-OTS key. The W-OTS keys have length $ln$, but each node of the XMSS tree should have length $n$. In order to make the size of the W-OTS keys compatible with the XMSS tree, the L-tree is used to first reduce the W-OTS key from $ln$ to $n$ bits.The L-tree ...


2

encrypt with the private key, and decrypt with the public key That statement, and the very name privateEncrypt, is incompatible with standard terminology: "public" means known to all and opposes to "private"; and "encrypt" implies transforming some information $X$ into $Y$ in a way such that if $Y$ becomes public, $X$ does not. ...


1

More incentive-based than crypto-based (anyway proposing it just because it means you are using someone else crypto ;-) ): append to the text going to be encrypted a reward, for example the privkey of a rich-enough Bitcoin UTXO, then monitor that UTXO. Of course to be effective you have to correctly value (from attacker POV) the "secret decryption"...


1

Perhaps an extensible version of the Twitter blue checkmark scheme? A trusted central authority (Jack) sets up a parameterised system that allows signing keys to be produced whose verification keys match identifiers. A Twitter service user (Lil Nas) sets up an account with Jack. Jack carefully verifies that Lil Nas is whom they claim (or simply allows them ...


2

Give each stakeholder a part of the secret key so that no subset of all intereested parties can decrypt the message. They all have to cooperate and share their parts in order to decrypt and they all have control over when they release their part to the others.


Top 50 recent answers are included