Re: electronic signatures

Peter Fairbrother wrote:
Mike Amling wrote:

Peter Fairbrother wrote:
From the UK's The Electronic Signatures Regulations 2002:

2. In these Regulations -
"advanced electronic signature" means an electronic signature -
....
(c) which is created using means that the signatory can maintain under his
sole control.


now an RSA decryption is mathematically the same operation as an RSA
signature,
A block box that raises its input i to the d power mod N can be used
for signature or decryption, but... Can a black box that accepts a hash
value h and returns a PSS digital signature on h also be used for
decryption? There may be a way, but I don't know of any.

It's very easy - present the block with a hash. Or with something that is in
fact data encrypted with the public key, but which pretends to be a hash. Or
something that is in fact a hash, but pretends to be encrypted data ...

Probabilistic Signature Scheme (PSS) only signs hashes that are shorter than the public key by some substantial margin, a good 160 bits if memory serves. The actual number which gets raised to the d power depends on 160 random bits generated as part of the signing process. See http://www.cs.ucdavis.edu/~rogaway/papers/exact.html for gory details. A black box that does PSS signatures does not give the provider of the hash to be signed sufficient control over the number than gets raised to the private exponent to allow decryption of a pre-specified RSA ciphertext.
Of course, a software implementation on a general purpose computer does not constitute a black box.


and if the gubmint can demand decryptions of data encrypted using
a RSA key - and anyone who knows the public key can use it to encrypt data,
and you have to know the public key in order to be able to tewll whether a
signature is valid - then it can in effect force people to sign things
against their will, thus preventing them from using RSA for an "advanced
electronic signature".

Do any of the other signature schemes not have this property, ie is there a
means which could be used to generate "advanced electronic signatures"?
A black box that generates DSA signatures is if anything even further
removed from what the said gubmint might construe as decryption, nicht?

Ah - I am not too knowledgeable on signatures, in fact it is the exact
question I was/am trying to ask - I have to complete my not-homework report
(for the UK Home Office) by tomorrow so I don't have time to google and
learn. Help?

If you don't know much about digital signatures, why has anyone asked you for a report on them?
You could do worse than start with http://en.wikipedia.org/wiki/Digital_Signature_Algorithm and note that the signing procedure does not, AFAICT, and I'm no expert, seem helpful in forming a DH shared secret from a given DH public key.
There are smart cards and tokens on the market that will generate a DSA key pair and sign things with it and from which it is purportedly difficult to extract the generated private key, including claims of resistance to timing and differential power attacks.

--Mike Amling
.

Relevant Pages

  • Re: How to verify a SignedData with Crypto++
    ... When I said CAPICOM does not support some of the algorithms, ... My problem is that I can't get the Crypto++ to verify the signature ... signature (RSA) using the public key and get the digest. ...
    (sci.crypt)
  • Re: Please help me to learn some implications of RSA signature creation equation
    ... I wish to be instructed  about some of the implications of the RSA signature ... It's a public key system (I know for a fact that HAC covers ... can hand someone a public key corresponding to your private key. ...
    (sci.crypt)
  • Re: Encrypt data
    ... the signature ... bytes exactly for a 1024 bit RSA key). ... public key. ... 3DES key) to encrypt any amount of data. ...
    (microsoft.public.platformsdk.security)
  • Re: RSA Decryption with public key?
    ... application knows the private key in a public key, ... The thingy that with RSA often referred as ... "Decryption with public key" is actually a *Signature Verification ...
    (microsoft.public.dotnet.security)
  • Re: Soft signatures
    ... now, digital signature, typically just represents that you (in ... For some time there were arguments that if a certificate contained the ... certificate with your public key and the non-repudiation flag in it. ... for a number of different business purposes. ...
    (sci.crypt)