15 03 2022

Lectured
Iigitignatures
Provides in Public
Integrity key Settings

PK SI Rt Ek
m

Is sign Sk m IF Vofy bk m
D
I 0

Inverse PKE
Signature of
in General
It is not true

softwaregmb.fm user

Vrty Pk 8
h Y Pn Key distribution
Why Not niac Problems
 Kac k ne
ke S ke

quad UT te Sign Skee V

I th Ftw
P Pa Pm
ke

kn w
Pk pk p ke

VrfyC1 I 1
I
Then Install

Cdigital Gen sign Urfa

signaturef
Ctk Gen Ci
Gene E

Sk M
sign t Sign
o
Voted b Vote et m
m
b l o is a valid signature of
0 Otherwise
Publicgerigrbitfanyone can merits

transferable B E
Cm a Cm D Cmr

Vestey Cm O I
PRA

we assume
spkaisassociatedwithA

Public key Infrastructure PEI

Me t ka is PublickeyofA

big It Sign Ska m

Ivetiftnatth
T.IM Certificate is valid
 TA
Ca Can

qit.im cannot any later

S es Ks Pks

CIA
Ég invents

What about MAC

Judg s K'SR
pl mst
is
MAC MIK'SR
Cong MAC are 213 orders of
magnitude efficienthansignatures

sigqma.MY
KSK Gen in me

find
Cm o
d
A wins iff Vfp mit I

m Q
 I Gen Sign Urfa is existentially
chosen
unforgeable under an adaptive
n
F neg
msg attack if F PPT A

7
Pr Sig Forge n
I Eneglen

name
Gen H H
Ty
IT Gen Sign Vofy
Gent Pk Sk Gen C'T
s Gen Ci

Pk Lbk A Sk Lsk s

me 0,13
Sign
te Heem
signs
Vote H em o I 1
votyp

If IT is a secure signature scheme

for msg of length la and

CR then t is secure
TH is

signature scheme for arbitrary length

messy
 ignafeschasdonRSAassmption
RSAassumption N p g
p g are large
primes
Given N it is hard to find P q

e 2 a god Ce O CN 1

10027 No
of N

N
S N F

God R 1
Enle totient
I
Function

IET
0 b p i

i
0 t g t 1 Ca
HW
Eulersthorems If god Cain I
then at I mod n
 N e d Gen RSA in
I I
to q
get
god Ce 0in I
get
Ed I mod
ofay
RSA
sa
tfVA.ae
N e d Gen RSA Ct

seat
III ydI
It wins if I
see
3
Y nd N
aedmaw

RSA problem is hard relative to

n

f PPT A F nege m a
Gen RSA if
Pr RSA in VA Garga
n I I neglen
 LamRsaencytion

N e d Gen RSA i

N p q
god Ce Oca I

ed I mad n

Pk L N e Sk Nd

End Kk Ln e ME 2nA
G memod N
e

Def m Ct mod N

med mod N

mk don t
mud N

In nod Nz m man
 Text book RBA Deterministic
so do not satify any of
the security notions

Many Attack References

PECS CPA secure

Padded RSA
OA EP RSA based CCA secure Encryption
Scheme

One way trapdoor permutation

easy to compute
to Invert
difficult
Easy to Invest with a

trapdoor

Ib 191 IN 1024 bit

Parameters
ape go bit dewitt
RSAsignatures
Gen LN e d Gen RSA in

Tk N e Sk 2N d

Sign Sk 2N dy meant
d med N
0 m

me 2N
Voted pk N e

s N E 2nF
if m I remod N

medmosen
I mel N
A No
msg Attack

MPW
Ml
J
em o

bk LN e

Choose uniform r
t
E Ent
compute mefmodN
Forgery find
ME any
I

m
ME NIE
Tend N
I Il nod N Mi Mr in
RSA FD RSA Full Domain Hash

deterministic function H
Use a

Gere N ed Gen RSA in H 91352nF

BK N e SK Nid

Sign Sk Ln dy me 013

O It m mod N

t
Wtf Pk N es me 0,13
FE 2nA

re Hem modN
 T Han d nod N

no
9 tnaii be interim to

Start with P

ME TO mod N
m
And then find m 2 H_cm

It should be hard to invert

M M Ma
It should be hard to find
HCM mad N
7 Hem Hemi

It should be hard to findcollisions

inHI H mi Alms
Me ma have same signature
 There is no to instantiate H in a
way
standard way

hard relative
17 If the RSA problem is
is modeled as a
to Gen RSA
RSA FDA is
Random Oracle then
scheme
a secure
signature