5 ms·
You cannot distinguish malicious from legitimate signatures. From the paper: 'This can be done in such a way that only the attacker, who made the malicious impl
by pg314 12y ago
You cannot distinguish malicious from legitimate signatures. From the paper: 'This can be done in such a way that only the attacker, who made the malicious implementation, can extract the secret from the signature, and that the distribution
of malicious signatures is polynomially indistinguishable from legitimate signatures by anybody else.'
- vessenes 12y agoHmm, I must have read too quickly. The initial analogy they used didn't have that property. Thanks!