New answers tagged

-1

The purpose of the aditional randomness is to avoid CPA (Chosen Plaintext Attack). A chosen-plaintext attack (CPA) is a model for cryptanalysis which assumes that the attacker can choose random plaintexts to be encrypted and obtain the corresponding ciphertexts. So, if the user signs the same - exact - document 2 times, the corresponding signature WILL be ...


1

What are the actual use cases for non-exportable keys? Why would people want to go that far while risking key losses? One of the main ideas of key stores is that access to the keys is minimized; as long as you don't export a key, you can be sure that no other service is using the key. Don't most people want to be able to reuse and back up their keys, ...


1

After some more research I found the answer from the BouncyCastle library. byte[] signature is RS encoded signature and the return value will be ASN.1 encoded signature. static byte[] concatenatedRSToASN1DER(final byte[] signature, int signLength) { int len = signLength / 2; int arraySize = len + 1; byte[] r = new byte[arraySize]; byte[] s = ...


2

If the attacker has the ability of choosing the private key, then he can create a valid signature $(r,s)$ with a target value for $s$ for any message $m$. The attack works in the following way: The attacker choose its target $s$, generates a random ephemeral key $k$ and computes the hash of the message $e = H(m)$. Then the attacker computes the scalar ...


1

Ignoring the case of $R$ being the point at infinity, I have found a patent that seems to describe the system you outline to a T: US 7,512,232 B2, which also makes me suspect that your "commercial" system ends up being Microsoft's in particular. It specifically notes that taking the square root modulo $\ell$ is a requirement. In other words, no, ...


1

What you need to do is find some document that associates you with the virtual or hardware wallet. The most obvious way is the receipt you used to purchase the physical wallet. If you didn't keep the receipt, the company you bought it from may be willing and able to help you.


1

So this is a solution I came up with based on this chat with @Maeher. We use proof by reduction to show if there exists an attacker $A$ with non-negligible advantage for $S_2$ we can use it to construct an attacker $B$ for $S$ with non-negligible advantage. If $$\Pr[vrfy(pk_0,m,\sigma_0) \;\; and \;\; vrfy(pk_1,m,\sigma_1)]$$ be non-negligible then easily ...


0

The behavior turned out to be a vulnerability. Details about it can be found here https://about.signpath.io/blog/2020/08/26/on-the-importance-of-trust-validation.html.


20

Indeed the text quoted is wrong; at the very least, by using incorrect vocabulary. That should be: if you sign a message with your private key, the paired public key can be used to verify the signed message's integrity and origin. What small amount of truth there is in the original statement boils down to: in some asymmetric cryptosystems, including RSA┬╣ (...


0

A hash function which isn't preimage resistent is also not collision resistance. If I hash a large random message and apply the preimage algorithm I'm extremely unlikely to get the same message I started with, thus finding a collision. Collision resistance is critical for a hash used in a signature. As you can create forged signatures. Even though you need a ...


Top 50 recent answers are included