they/them
It looks like it exploits what Vaudenay warned against in 2004 : "Digital Signature Schemes with Domain Parameters" ( https://lasec.epfl.ch/pub/lasec/doc/Vau04b.pdf … )https://twitter.com/NSAGov/status/1217152211056238593 …
Prikaži ovu nit
-
1. Find an ecc root cert C 2. Create C' with the same public key and curve but set the generator to the public key of C 3. Create a normal signing cert C'' with key pair (pk'',sk'') and sign software/cert with sk'' 4. Sign C'' with sk=1 5. Ship software/cert with C'' and C'
Prikaži ovu nit
for context: A defined curve has an order n [prime number] and a generator point G [point] privKey ≡ random number [integer] pubKey ≡ privKey * generator [scalar * point = point] the part I don't quite get yet is where the generator/"curve" is stored and if it is modifiable
-
-
because I thought the "curve" was a fixed thing, so which part is stored in the cert if any? can you have custom ones and it will still accept them? source on terms:https://cryptobook.nakov.com/digital-signatures/ecdsa-sign-verify-messages …
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.