We present a polynomial-time algorithm that provably recovers the signer's secret DSA key when a few bits of the random nonces k (used at each signature generation) are known ...
We put forward a new method of constructing Fiat-Shamir-like signature schemes that yields better "exact security" than the original Fiat-Shamir method. (We also point o...
In theoretical cryptography, one formalizes the notion of an adversary's success probability being "too small to matter" by asking that it be a negligible function ...