| |||||||||||||
Forward secure sealingForward secure sealingPosted Aug 25, 2012 19:00 UTC (Sat) by nybble41 (subscriber, #55106)In reply to: Forward secure sealing by dlang Parent article: Forward secure sealing
> The problem with using a symmetric key is that the person trying to validate the signature is also in a position to forge the signature.
Yes, but that doesn't matter here, since the person doing the validation is also the person who administers the server; they're _already_ in a position to forge log messages, if they cared to do so.
You are correct that the signing key is basically just the output from a PRNG, but the PRNG does need to have a special property that some PRNGs lack: the computation must only work in the forward direction. Given the internal state of the PRNG, it must not be possible to go back to a previous state and generate a past signing key.
For example, both the following functions will produce a stream of pseudo-random numbers:
F[0] = HASH(seed)
G[n] = HASH(seed + n)
However, only the former PRNG would be suitable, because computing G[n] requires the original seed value, and given the seed you can compute any G[n], past or future.
(Log in to post comments)
|
|||||||||||||