Signature Scheme Attacks

Cryptography · Axiom Academy

LESSON Signature Scheme Attacks Understanding vulnerabilities and attacks on digital signature schemes 1. Attack Models and Threat Taxonomy Attacks on signature schemes are classified by the adversary's capabilities and the information they can access. Understanding these models helps evaluate security guarantees. Key-Only Attack: Adversary has only the public key Known-Message Attack: Adversary has signatures on known messages Chosen-Message Attack: Adversary chooses messages and obtains signatures Adaptive Chosen-Message Attack: Adversary adapts choices based on previous signatures Many signature schemes (DSA, ECDSA) require a random nonce k for each signature. Reusing nonces catastrophically breaks security. In ECDSA, signatures are computed as: If the same nonce k is used for two different messages m1 and m2: 3. Bleichenbacher's Attack on RSA PKCS#1 v1.5 This padding oracle attack exploits the structure of PKCS#1 v1.5 padding in RSA signatures. The attack allows signature forgery for certain messages. The attack exploits implementations that don't verify padding correctly: 4. Fault Attacks (Bellcore Attack on RSA-CRT) Fault attacks induce errors during signature computation to leak secret information. The Bellcore attack targets RSA implementations using the Chinese Remainder Theorem (CRT). 5. Side-Channel Attacks on Signature Generation

This is the written version of the interactive lesson above. See the full Cryptography course.