New answers tagged

1

The difference is that in homomorphic signatures anyone can compute on the signatures, whereas in functional signatures only the party holding the functional secret key $sk_f$ can compute $f$ on signatures (signed by master secret key corresponding to $sk_f$)


2

The thing that makes subtle crypto almost entirely useless is the lack of key management. Although you seem to use the primitives in the correct way, the key management is not specified at all in your question. If, for instance, you cannot trust the TLS connection, then what chance is there that the public key used for encryption is trusted? About none. ...


-1

Hash = A result of a mathmatical function that is difficult to reverse engineer. The result of applying hash to a text is a long code. Examples of hashes: MD5, SHA1. The length of MD5 code is 128 bits, the length of SHA1 code is 160 bits. With a hash: You cannot revert back to the original message. But the same message will always give the same hash. So if ...


0

Normally CSR does not need to be secret. CSR is signed by the applicants private key. If an attacker intercepts a CSR, changes email address and sends CSR on CA, CA will reject it, because the signature will not match the content of the CSR. If the attacker signs the changed CSR with attackers private key, the signature will still be invalid, because it ...


1

After doing some digging, I think it may just be a matter of IND-CCA3 (see the end of this answer and this paper) being meant instead of the, perhaps usually implied, IND-CCA2. In particular, the specific use of asymmetric cryptography for authentication of the sender may be the sticking point. When talking about encrypt-then-MAC, the mechanism by which the ...


5

I am not sure how the IND-CCA experiment in this case works. Well, it doesn't really. There are no verification keys designated as such in the CCA experiment and there is no designated sender in the definition of a public key encryption scheme at all. So, the only way to communicate to the receiver who supposedly encrypted a ciphertext would be to put it in ...


0

In a zero-knowledge proof system, there are three main properties to be satisfied: completeness, soundness (knowledge soundness for zkpok), and zero-knowledge (or weaker notion such as witness indistinguishability). one of soundness and zero-knowledge is computationally error-bounded, i.e. you can either than a (computational soundness + statistical zk) ...


4

Is there a signature scheme in which $\text{signature} = \mathsf{Sign}(\text{message} \mathbin\| \text{signature})$ ? With standard RSA signatures (RSASSA-PKCS1-v1_5, RSASSA-PSS of PKCS#1), that's possible if one chooses the public/private key pair for that purpose, as a function of the message. On top of that one can even make the signature nearly anything ...


Top 50 recent answers are included