Selective forgery of RSA signatures with fixed-pattern padding

We present a practical selective forgery attack against RSA signatures with fixed-pattern padding shorter than two thirds of the modulus length. Our result extends the practical existential forgery of such RSA signatures (Brier et al., 2001). For an n-bit modulus the heuristic asymptotic runtime of our forgery is comparable to the time required to factor a modulus of only 9/64 n bits. Thus, the security provided by short fixed-pattern padding is negligible compared to the security it is supposed to provide


Published in:
Public Key Cryptography. 4th International Workshop on Practice and Theory in Public Key Cryptosystems, PKC 2002. Proceedings (Lecture Notes in Computer Science Vol.2274), 228 - 36
Presented at:
Public Key Cryptography. 4th International Workshop on Practice and Theory in Public Key Cryptosystems, PKC 2002. Proceedings (Lecture Notes in Computer Science Vol.2274), Berlin, Germany
Year:
2002
Keywords:
Laboratories:




 Record created 2010-06-25, last modified 2018-03-17

n/a:
Download fulltext
PDF

Rate this document:

Rate this document:
1
2
3
 
(Not yet reviewed)