1. Introduction to Modern Cryptography
Interactive Learning Session
Week 7: Digital Signatures
Thursday, 17 March 2016, 15:00-17:00

2. Plain RSA signatures
Give a no-message attack, i.e. a forgery without querying the signature oracle
Remember how to forge a signature on an arbitrary message by requesting signatures on two other messages

3. Encoded RSA Signatures
See homework!

4. RSA Full-Domain-Hash Signature

5. Schnorr Identification Scheme
𝑦 −1 =751
𝐼=3 21 =734
𝐼=3 1 =3
𝐼=3 𝑘 = …
𝑟=391
𝑟=665
𝑟=250
X=666
s = 391 * mod 1012
𝑠=343
𝑠=647
𝑠= ?
3 343 ⋅ =734
3 647 ⋅ =3
3 𝑠 ⋅ = 3 𝑘
Use your eavesdropped knowledge and try identify yourself!

6. Schnorr Identification Scheme
𝑦 −1 =751
𝐼=3 21 =734
𝐼=3 1 =3
𝐼=3 776 =858
𝑟=391
𝑟=665
𝑟=250 …
X=666
s = 391 * mod 1012
𝑠=343
𝑠=647
𝑠=296
3 343 ⋅ =734
3 647 ⋅ =3
3 296 ⋅ =858
Generate a valid (and properly distributed) transcripts yourself!

7. Schnorr Identification Scheme
𝑦 −1 =751
𝐼=3 21 =734
𝐼=3 1 =3
𝐼=3 776 =858
𝑟=391
𝑟=665
𝑟=250
𝑠=343
𝑠=647
𝑠=296
124^(-1) mod 1012 = 482
3 343 ⋅ =734
3 647 ⋅ =3
3 296 ⋅ =858
𝐼=3 21 =734
𝑟=390
Extract the secret key!
𝑠=689
3 689 ⋅ =734

8. Schnorr Identification Scheme
𝑦 −1 =751
𝐼=3 21 =734
𝐼=3 1 =3
𝐼=3 776 =858
𝑟=391
𝑟=665
𝑟=250
𝑠=343
𝑠=647
𝑠=296
124^(-1) mod 1012 = 482
3 343 ⋅ =734
3 647 ⋅ =3
3 296 ⋅ =858
𝐼=3 21 =734
𝑟=390
Extract the secret key!
343− −390 =666 𝑚𝑜𝑑 1012
𝑠=689
3 689 ⋅ =734