Alice is using RSA digital signatures. When she signs 2 messages m₁ and m2 with signatures s(m₁) and s(m₂) and sends them to Bob, Eve intercepts all 4 pieces of this information. Eve now wants to forge the signatures for one of the following 3 messages (all considered as elements mod N, the public RSA modulus). One of them is easier than the others. Find it and show that Eve can forge it. 1. m = m1m2; 2. mm₁ + m2; 3. m 2 * M₁.

Alice is using RSA digital signatures. When she signs 2 messages m₁ and m2 with signatures s(m₁) and s(m₂) and sends them to Bob, Eve intercepts all 4 pieces of this information. Eve now wants to forge the signatures for one of the following 3 messages (all considered as elements mod N, the public RSA modulus). One of them is easier than the others. Find it and show that Eve can forge it. 1. m = m1m2; 2. mm₁ + m2; 3. m 2 * M₁.

Database System Concepts

7th Edition

ISBN:9780078022159

Author:Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan

Publisher:Abraham Silberschatz Professor, Henry F. Korth, S. Sudarshan

Chapter1: Introduction

Section: Chapter Questions

Problem 1PE

See similar textbooks

Similar questions

One potential limitation of a digital signature is that for a given signature σ of a message m corresponding to a public key pk, one could generate a pk', sk' that produces a signature σ' for m, such that σ' = σ. Given a signing function S, a verification function V, that each takes corresponding private and public keys for generating and verifying a signature and is vulnerable to these duplicate keys, please generate S' and V' that are immune to a duplicate keys attack.
The following system is proposed for securely communicating a 256-bit message m:A→B:i,m⊕h(i)That is, Alice sends Bob an integer i and the message m xor'ed with a SHA-256 hash of i. (SHA-256 produces a 256-bit digest, so the lengths of h(i) and m are equal.) Bob can decode the message m⊕h(i) by hashing i (which is communicated as plaintext), and can thus derive m, since (m⊕h(i))⊕h(i)=m.Show that this scheme is very broken and that a passive eavesdropper can trivially learn m.
Alice and Bod have decided to use a symmetric encryption algorithm. They have someassumptions about their messages:- Messages only contain capital letters (i.e. A to Z)- The length of their shared key must be greater than or equal to the length of the plaintext- They assign each letter a number as follows: (A,0), (B,1), (C,2), (D,3),…, (Z,25)Their algorithm combines the key and the message using modular addition. The numerical valuesof corresponding message and key letters are added together, modulo 26. For example, if the plaintext is “HELLO” and the key is “SECRET” then the encrypted message is calculated as following:Since the length of the plaintext is 5, we just need the first 5 letters of the key (i.e. “SECRE”), thenfor each letter, we should add corresponding letters in both the plaintext and the key modulo 26.Plaintext: H (7) E (4) L (11) L (11) O (14)Key: S (18) E (4) C (2) R (17) E(4)Cipher: Z (25) I (8) N(13) C(2) S (18) a) Write a program in Python, C/C++ or JavaScript to…
Suppose we have the encoding that enables Carol to mount the cube root attack (see The Cube Root Problem). If Carol sends a message to Bob, supposedly signed by you, will there be anything suspicious and noticeable about the signed message, so that with very little additional computation Bob can detect the forgery? Is there anything Carol can do to make her messages less suspicious? Cuberoot problem: Let's say you pad on the right with random data. You chose that scheme so that there is a negligible probability that anything you sign will be smooth. However, if the public exponent is 3, this enables Carol to forge your signature on virtually any message she chooses! Let's say Carol wants your signature on some message. The message digest of that message is h. Carol pads h on the right with zeroes. She then computes its ordinary cube root and rounds up to an integer r. Now she has forged your signature, because re = r3 = (h padded on the right with a seemingly random number).
Let's assume that Bob and Alice share a secret key in a symmetric key system. Bob wishes tobegin a conversation with Alice, and sends her a message that essentially says "let's talk". Aliceis suspicious that the person contacting her might not be Bob, so Alice generates a single-userandom number (a nonce) and sends it to Bob. Bob encrypts the nonce with the secret key heshares with Alice and sends it back. Alice decrypts this message and retrieves the same nonceshe sent to Bob. Which of the following is true, provided the secret key K has not been compromised?
Let Π = (Gen,Enc,Dec) be a private-key encryption scheme that has indistinguishable en- cryptions in the presence of an eavesdropper. Which of the following encryption schemes are also necessarily secure against an eavesdropper? If you think a scheme is secure, sketch a proof, if not, provide a counterexample. Here, for a bit string s, parity(s) is 1 if the number of 1’s in s is odd, and 0 otherwise. The || symbol stands for concatenation. So, for strings if x = 00 and y = 11, x||y = 0011. (a) Enc1k(m) = 0||Enck(m)(b) Enc2k(m) = Enck(m)||parity(m) (c) Enc3k(m) = Enck(m)||Enck(m)(d) Enc4k(m) = Enck(m)||Enck(m + 1). Here think of m as an integer. Please type answer note write by hend.
Alice sets up an RSA public/private key, but instead of using two primes, she chooses three primes p, q, and r and she uses n=pqr as her RSA-style modulus. She chooses an encryption exponent e and calculates a decryption exponent d. Encryption and Decryption are defined: C ≡ me mod n and m ≡ Cd mod n where C is the ciphertext corresponding to the message m. Decryption: de ≡ 1 mod φ(n) | Let p = 5, q = 7, r = 3, e = 11, and the decryption exponent d = -13. n = 105 & φ(n) = 48 Q: Alice upgrades to three primes that are each 200 digits long. How many digits does n have?
An affine cipher has the form c = (am+b) mod n. Suppose m is an integer between 0 and 25, eachinteger representing a letter.(a) Let n = 26, a = 3, and b = 123. What is the ciphertext corresponding to the phrase THIS IS A CIPHERMESSAGE.(b) A requirement for a cipher is that every plaintext letter correspond to a different ciphertext letter. If either aand b is not relatively prime to n, does the affine cipher meet this property? Either prove it does or presenta counterexample.
Suppose Alice has a public key with modulus 815153 and encryption exponent 91. Eve intercepts a ciphertext 766247from Bob that was encrypted using this key. She calculates 766247⋅941^91(mod815153)=143804 and asks Alice to decrypt this message as an authentication test. Alice responds with the decrypted message 167698 Find the plaintext without factoring Alice’s modulus.
How does Alice verify that a message M that was signed by Bob using RSA is really from Bob? Assume that eA and dA are the encryption and decryption exponents for Alice while eB and dB are those for Bob. The agreed upon hash function is h. All congruences are mod N and Alice has Bob's certificate. Question 10 options: She compares h(M) to DSdA mod N She compares h(M) to DSdB mod N She compares h(M) to DSeB mod N She compares h(M) to DSeA mod N
For the Zhou-Gollman non-repudiation protocol discussed in the lecture on “Non-Repudiationand Anonymity Protocols”, which one of the following statements is false:a) At time point 4, both A and B can produce evidence to prove that they received Kb) At time point 2, both A and B can produce evidence to prove that they received a signedmessage from the other partyc) At time point 0, S cannot prove anythingd) At time point 3, B cannot produce evidence to prove that A has access to key Ke) At time point 1, A can prove that B is alivef) At time point 4, S can prove that A is aliveg) At time point 3, S can produce evidence that that A has access to key Kh) At time point 0, A is not alivei) At time point 2, A can produce evidence to prove that B is alivej) At time point 4, the protocol terminates
We have the following encryption scheme for message space . Gen will uniformly choose the key k from the key space . Enc(k, m) returns and Dec(k, c) returns . Is EAV secure (computationally indistinguishable)?