Review on ElGamal signature

1
Review on ElGamal signature

• ßaa (mod p) a secret (ß,a,p) public
• Sign a message m
• select random k s.t. gcd(k,p-1)1
• r ak (mod p)
• sk-1(m-ar) (mod p-1)
• (m,r,s) is signed message
• Verify signature
• v1 ßrrs (mod p) v2 am (mod p)
• Check v1v2 (mod p)

2
Question 2 p.191

• (x,?,d) is a signed message.
• Choose h s.t. gcd(h,p-1)1
• Define ?1 ?h (mod p)
• d1 d ?1 h-1 ?-1 (mod p-1)
• Find x1 s.t. (x1, ?1, d1) is a valid signature.

3
Solution

• We calculate
• v1 ß?1 ?1d1 (mod p) v2 ax1 (mod p)
• ?1 ?h (mod p) akh (mod p)
• d1 d ?1 h-1 ?-1 (mod p-1)
• d ?h h-1 ?-1 (mod p-1)
• d ?h -1 h-1 (mod p-1)
• ß aa (mod p)

4
Solution

• So v1 (aa )?1 (akh) d ?h -1h-1
• a a ?1 k d ?h -1
• Condition v1 v2 (mod p)
• a ?1 k d ?h -1 x1
• a ?h k d ?h -1 x1
• ?h -1 (a ? k d ) x1 ()
• We also have d k-1(x-a ?) (mod p-1) because
  (x,?,d) is a signed message
• a ? k d x
• ?h -1 x x1 (from () )

5
Question

• This method allows Eve to forge a signature on
  the message x1 ( because Eve does not need to
  know a when form the triple (x1,?1, d1) )
• But this is unlikely to cause problems because
• x1 ?h -1 x ()
• So if we choose a random h , then x1 is not
  meaningful . Otherwise, if we choose h to satisfy
  () then we have to solve discrete logarithm
• x1x-1 ?h -1 (mod p)