MHB How can we find the private key?

  • Thread starter Thread starter mathmari
  • Start date Start date
AI Thread Summary
Alice utilizes the ElGamal signature scheme with parameters p=47, q=23, and g=2, generating signatures for two messages with identical r values. The correct relations for the signatures are clarified as s1=k1^{-1}(h(m1)+ar1) and s2=k2^{-1}(h(m2)+ar2), indicating that k1 and k2 are equal due to the shared r value. By substituting the known values into these equations, two equations can be formed with the unknowns k and a. This method allows for the calculation of Alice's private key without needing to compute a discrete logarithm. The discussion emphasizes the importance of correctly interpreting the signature equations for solving the problem.
mathmari
Gold Member
MHB
Messages
4,984
Reaction score
7
Hey! :o

Alice uses the ElGamal signature scheme with the variables $p=47$, $q=23$ and $g=2$. For two different messages $m_1, m_2$ with $h(m_1)=4, h(m_2)=3$ she produces the signatures $(r_1, s_1)=(14, 8)$ and $r_2, s_2)=(14, 15)$. Calculate the private key of Alice, without calculating a discrete logarithm.

We have the following relations: $$r_1=g^{k_1} \ \ , \ \ s_1=k_1^{-1}(h(m_1)+af(r))\pmod q \\ r_1=g^{k_2} \ \ , \ \ s_2=k_2^{-1} (h(m_2)+af(r))\pmod q$$

What can we do to find $a$ ?? (Wondering)
 
Mathematics news on Phys.org
mathmari said:
Hey! :o

Alice uses the ElGamal signature scheme with the variables $p=47$, $q=23$ and $g=2$. For two different messages $m_1, m_2$ with $h(m_1)=4, h(m_2)=3$ she produces the signatures $(r_1, s_1)=(14, 8)$ and $r_2, s_2)=(14, 15)$. Calculate the private key of Alice, without calculating a discrete logarithm.

We have the following relations: $$r_1=g^{k_1} \ \ , \ \ s_1=k_1^{-1}(h(m_1)+af(r))\pmod q \\ r_1=g^{k_2} \ \ , \ \ s_2=k_2^{-1} (h(m_2)+af(r))\pmod q$$

What can we do to find $a$ ?? (Wondering)

Hi mathmari,

I don't understand the $f$ in your relations. The relations should be,

\[s_1=k_1^{-1}(h(m_1)+ar_1)\pmod q \]

\[s_2=k_2^{-1} (h(m_2)+ar_2)\pmod q$\]

Refer: https://en.wikipedia.org/wiki/ElGamal_signature_scheme

Note that, $r_1=g^{k_1}\mbox{ and }r_2=g^{k_2}$. Since $r_1=r_2$ it implies that, $k_1=k_2=k$.

Now all you a got to do is substitute the given values into the equations and you'll get two equations with $k$ and $a$ as unknowns.
 
Ok... Thanks a lot! (flower)
 
mathmari said:
Ok... Thanks a lot! (flower)

You are welcome. :)
 
Suppose ,instead of the usual x,y coordinate system with an I basis vector along the x -axis and a corresponding j basis vector along the y-axis we instead have a different pair of basis vectors ,call them e and f along their respective axes. I have seen that this is an important subject in maths My question is what physical applications does such a model apply to? I am asking here because I have devoted quite a lot of time in the past to understanding convectors and the dual...
Insights auto threads is broken atm, so I'm manually creating these for new Insight articles. In Dirac’s Principles of Quantum Mechanics published in 1930 he introduced a “convenient notation” he referred to as a “delta function” which he treated as a continuum analog to the discrete Kronecker delta. The Kronecker delta is simply the indexed components of the identity operator in matrix algebra Source: https://www.physicsforums.com/insights/what-exactly-is-diracs-delta-function/ by...
Back
Top