New answers tagged

1

If we use constant $k$ in this scheme we can find the secret key like this: We know $(m_1,r_1,s_1)$ and $(m_2,r_2,s_2)$ for two different plaintext, as k is constant $r_1=r_2=r$ so we have this equivalence: $$s_1k-m_1\equiv-ar\equiv s_1k-m_1\ mod\ p-1 \Rightarrow (s_1-s_2)k \equiv m_1-m_2\ mod\ p-1$$ This equivalence has $d$ answer where $d=gcd(s_1-s_2,p-1)...


3

whether the checksum: 0xFFFF-SUM(N[i]) i=1...32 will solve the problem? Yes, it does. That's exactly how both WOTS+ in XMSS and LM-OTS in LMS work


1

Threshold signatures do not enforce accountability meaning a t-out-of-n threshold signature does not tell the verifier which $t$ of the $n$ signers created the signature. Multisignatures enforce accountability as the verifier learns which t signers created the signature. There does not need to be a threshold for multi-signatures. But n-out-of-n threshold ...


2

Is step #3 (verifying the EMSA-PKCS1-v1_5 padding) important to the security of the system? Yes. That's paramount for small RSA public exponent $e$. For $e\in\{3,5,7\}$, the easily computed integer $s=h^{(e^{-1}\bmod2^{254})}\bmod2^{256}$ is an acceptable signature for any message with an odd SHA-256 hash $h$ (that is about one message out of two). The ...


2

Should I always call the key used for verification "public key" even on those settings? Usually it is a public key, or at least it is called that in the key pair generation procedure of the cryptosystem that is used. Public key is in that case a more generic term - it may not be decided for what the key will be used after all. Similarly, cryptographic API'...


1

I think Crypto++ will help you. This is a cryptography library implemented in C++. Its homepage: Crypto++ Library.


2

Libsodium is written/implementable in C++, C and Python. It implements lots of crypto systems, such as public key cryptography. Here is the intro in the docs: https://libsodium.gitbook.io/doc/


1

Note you're doing direct division instead of modular inverse. Since there is no division in elliptic curve arithmetic, you need to do mod inverse. pow function could be used as a helper here; it takes third argument as modulus: >>> P = 2 ** 255 - 19 >>> X = 15112221349535400772501151409588531511454012693041857206046113283949847762202 >&...


0

The answers of @Lery and @SamG101 are good. In cases when receiver wants to be sure that the message comes really from you and not from smb. else who pretends to be you, such signature is sufficient. But in some cases it is important to show who was the first one who sent the message, for instance, who was the first to solve some important problem. In such ...


1

What you need is a digital signature algorithm. Public key cryptography means that you have a public and private key. The server can sign a message by performing some maths on it using his private key. All the clients, who know the servers public key, can then do some maths to verify the signature using the servers public key, proving the authenticity. ...


1

Yes, this is a way to establish authenticity through the use of a so-called "shared secret". In practice you could do it using the HMAC algorithm and a shared key between the server and clients. Notice that here, there is a problem with shared keys: that is that the whole system is not secure as soon as one client is breached. There are also other ways to ...


0

Let $d_1, d_2$ be inverses of $e_1,e_2$ respectively mod $(p-1)(q-1)$ where $N=pq$ with $p,q$ two large primes. To sign the message $m_1$, you will compute $s_1={m_1}^{d_1}\ [N]$. To verify the signature, provided $m_1, s_1$, one will compute ${s_1}^{e_1}\ [N]$ and check whether this equals to the message $m_1$ or not.


4

It uses deterministic padding, i.e. padding with FF octets, finalized by a single 00 valued byte. So it is indeed RSASSA-PKCS1-v1_5 which uses EMSA-PKCS1-V1_5-ENCODE. Don't be fooled by the reference to RSA encryption in the OID for sha256WithRSAEncryption. That simply points to the modular exponentiation - in this case with the private key. PKCS#1 versions ...


0

Your design is exploitable to MITM (man-in-the-middle) attack, an attacker can intercept your message and deliver "personal tampered message" encrypted with receiver's public key.


Top 50 recent answers are included