Digital Signatures

Question 1

How do electronic signatures work?

Answer 1

You create a binary signature and append it to any document you send.
The opposing party then verifies the digital signature using the public key on the other end.

Question 2

What is the difference between symmetric signing and asymmetric signing?

Answer 2

Symmetric signing uses the same key for signing and verification, so it’s fast but doesn’t support non-repudiation.
Asymmetric uses a private key to sign and a public key to verify, which provides non-repudiation

Question 3

How efficient are digital signatures?

Answer 3

Digital signature verification and signing both require a single use of the square and multiply algorithm, where the efficiency depends on the exponents

Question 4

What is the overarching definition of Signature Forgery in Cryptography?

Answer 4

Signature forgery is the ability to create a valid message/signature pair (m, s), where m hasn’t been previously signed by the legitimate signer.

Question 5

What is Existential Forgery?

Answer 5

• Existential Forgery is when the attacker is able to create a valid message/signature pair (m, s)
• There are no constraints on m, it may well be entirely random
  m does not need to be a valid message to be understood by a recipient

Question 6

What is Selective Forgery?

Answer 6

• The attacker is able to create a valid message/signature pair (m, s) where they have selected m in advance
• m may have some mathematical properties, or be all zeroes, etc…

Question 7

What are Universal Forgeries?

Answer 7

• They are a type of attack where the attacker can create a valid signature from any message m
• Strongest type of attack, and implies the previous two types of attacks
• Example of attack: In RSA, it would imply the attacker had obtained the private key

Question 8

What is Malleability in the context of Digital Signatures?

Answer 8

Given two messages, and corresponding signatures:
message 3 with signature 3 is equivalent to (m1 * m2, s1 * s2) mod n

Question 9

What is a weakness with textbook implementations of RSA?

Answer 9

Malleability

Question 10

How can you defend against forgery attacks?

Answer 10

• Implement padding: Likelihood of successful attack is 2 ^(-y)
• Hash-then-sign
• PKCSv1.5
• RSASSA-PSS

Question 11

How does Hash-then-sign work?

Answer 11

You hash the message within a padding scheme
Then verification will recompute the hash later

Question 12

What makes hash-then-sign an effective defensive measure?

Answer 12

Existential forgeries are harder, as you’d need a random message that’s also a valid hash.

Question 13

How does PKCSv1.5 work?

Answer 13

It uses both padding and hashing for increased security, which prevents existential forgeries and attacks on small messages.

Question 14

What is RSA Signature Scheme with Appendix i.e. RSASSA-PSS?

Answer 14

The Appendix refers to any scheme that sends (m, s) separately.
The probabilistic signature produced by this scheme adds a random salt to the process, meaning repeated signatures on the same document produce different results

Question 15

How does PSS Encoding work?

Answer 15

• Hash message
• Concatenate padding, hash and salt to create M’
• Hash M’ into final hash H
• Append padding to salt to create data block DB
• Expand H using MGF
• Calculate DB xor MGF(H) to created masked DB
• Output is masked DB, H and a constant 0xbc
• Use RSA to calculate signature and send (m, s) as normal

Question 16

How does PSS Verification work?

Answer 16

• Use RSA public key to obtain unsigned signature
• Check length and 0xbc constant
• Split signature into masked DB and H
• Calculate MGF(H) and therefore DB
• Check DB padding
• Recreate M’ from padding, message and salt
• Calculate H(M’)
• Verify H(M’) = H