The Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. It was proposed by the National Institute of Standards and Technology (NIST) in August 1991 for use in their Digital Signature Standard (DSS), specified in FIPS 186, adopted in 1993. ...

learn more… | top users | synonyms (1)

-1
votes
1answer
27 views

How to test digital signatures between two computers?

I have to test a digital signature algorithm. I have two computers, one will be signer and the other one is verifier. I implemented both of these in C++ but I do not know how to test it. Computers are ...
3
votes
1answer
310 views

Simple digital signature example that one could compute without a computer?

I am working on a document to explain Bitcoin to students. But I am having a hard time translating the principle described in §2 of the Bitcoin whitepaper in layman's terms. There is a great question ...
0
votes
0answers
4 views

OpenSSL: Generate ECDSA key and CSR [migrated]

I know how to generate an RSA Private Key and CSR: openssl genrsa -out my.key.pem 2048 openssl req -new -sha256 -key my.key.pem -out my.csr But, How do I do the ...
1
vote
1answer
21 views

Time efficiency of Bitcoin Multi-signature Vs. threshold signature

I read this paper (Securing Bitcoin wallets via a new DSA/ECDSA threshold signature scheme) that illustrated that threshold signature is the best solution to avoid single point of failure but I think ...
3
votes
1answer
387 views

When would I need DSA as opposed to RSA for digital signature?

The digital signature algorithm encrypts a hash using the senders private key and the receiver's public key. This multiple encryption is a pretty expensive process since public key encryption is so ...
2
votes
1answer
50 views

Why does DSA require that a new $k$ be chosen and the algorithm restarted if $s=0$?

DSA is an algorithm used to generate a digital signature, which consists of a pair of values $(r,s)$. The algorithm computes $r$ first and then $s$. However, if we calculate $s=0$, it says to restart ...
1
vote
0answers
28 views

Getting a key size of DSA/Elgamal certificate

I've tried to get a public key size of DSA/Elgamal PGP certificate. Using the Cleopatra I find out that there is actually two public keys - one with DSA with key ...
0
votes
0answers
24 views

Diffie-Hellman combined with DSA/RSA

we have learned Diffie-Hellman, RSA and DSA (Digital Signature Algorithm) in university. Because DH is vulnerable of Man-in-the-Middle we had the task to program the DH combined with RSA to protect ...
3
votes
1answer
78 views

How to verify a sever's ECDSA fingerprint during SSH

I have read somewhere that Servers which have SSH access for users in the public can have their public key posted publicly (e.g., on a website), so that people who access such a server using SSH can ...
0
votes
1answer
75 views

Comparison Affine Coordinates and Projective Coordinates Addition in Excel

Kurve : EC : $y^2=x^3 + x + 1$ Generator:$(1,7)$ $p=23$ Result in Affine use Excel: $P=(1,7)$, $Q=(7,11) \implies P+Q=(18,20)$ Result in Projective use Excel: $P=(1:7:1), Q=(7:11:1) \implies P+Q=(15:...
0
votes
1answer
150 views

ECDSA non random k - Retrieve private key [closed]

At the moment I'm playing around with ECDSA. I know that I can retrieve the private key if the same K is used to sign two messages. I tried to use this script: Ruby Script to crack the private key. ...
5
votes
1answer
235 views

ECDSA key recovery - floating point values

I'm currently attempting to recover an ECDSA key. I have $m$, $m'$ and signatures $(r, s)$, $(r', s')$, and I know that $k$ is constant, the curve is NIST P-192 and the hash function of the. As such,...
7
votes
1answer
227 views

Are there security issues with discrete logarithm keys not being uniformly distributed?

Generally, algorithms based on discrete logarithm specify that private keys are chosen as scalars between 1 and the order of the group (denoted $q$ here). For instance IEEE P1363 and FIPS 186-3 both ...
6
votes
2answers
5k views

Why can’t DSA be used for encryption?

This question at StackOverflow mentions that DSA cannot be used for encrypt. But Both RSA and DSA can be used to generate public and private keys, right? (Or am I wrong?). Then why can't I use the ...
2
votes
1answer
66 views

Why is DSA falling out of favor?

Windows abandoned DSA rather than extend it to support > 1024 bits; but otherwise I cannot find a reason why DSA would be less desirable. I see in SSH the disabling it by default with a completely ...
0
votes
2answers
59 views

Stripping off message authentication or signature

If attackers can strip off RSA / EC / -DSA digital signature and conduct CCA on AES-CTR or CBC payload, why can't they do the same for AES-GCM?
1
vote
1answer
83 views

Does OpenSSL apply ASN1 encoding to the hash before signing using ECDSA?

I read on stack overflow that OpenSSL performs ASN1 encoding to the hash before signing it for, for ECDSA. In other words, OpenSSL performs the following steps when for an Elliptic curve key ...
5
votes
0answers
60 views

Software timing attack using Kocher method

What's the minimum number of random sample points needed in Kocher's timing attack, so that we can determine enough valid measurements of $A_{i,r}$ and $D_{i,r}$? I'm working from this paper: Volker ...
0
votes
0answers
40 views

How common are non-RSA digital certificates?

Is there a statistic available that shows just how common are DSA or ECC certificates amongst webservers? I know that RSA-based certificates are the most common, however I'd like to know, if there is ...
0
votes
0answers
31 views

Is original DSA a TEGTSS-I scheme?

Brickell et al. define TEGTSS-I scheme in paper "Design validations for discrete logarithm based signature schemes" In this paper original DSA is generalized as DSA-I variant where $r = g^k \bmod p \...
3
votes
1answer
92 views

What is the intuition for ECDSA?

I understand DH and ElGamal and RSA encryption/signatures. But when I look at ECDSA (or plain DSA), it seems like the formulas are just pulled out of thin air. I can verify that the algebra used in ...
1
vote
1answer
88 views

Better security than SHA1 for signature?

An application that I maintain uses Sparkle Update to update itself. I expect attacks from high level attackers (China, USA's NSA, etc.) and have some questions about how secure the cryptography ...
0
votes
0answers
38 views

timing attack ecdsa scenario in software implementation

Timing attack ecdsa in software with standalone program is it possible? There is paper discuss timing attack ecc in client server scenario in openssl,but i still dont understand it. Any body can ...
3
votes
2answers
287 views

Is there any reason to use RSA or DSA when we have ECC?

I am having trouble coming up with a use case for RSA or DSA. It appears that ECC is better in every way. Is this true? I am looking for cases where RSA/DSA is superior to ECC, not where it is used ...
2
votes
1answer
104 views

Shouldn't a signature using ECDSA be exactly 96 bytes, not 102 or 103?

Attempting to use openssl to create a signature is confusing on several levels: If I'm using it to sign a hash that I've already created (HMAC-SHA-384-192, specifically), a. why must I specify ...
1
vote
1answer
255 views

How can a lattice attack be applied to ECDSA signatures?

The aim is to check if it is possible to break the ECDSA cryptosystem under the following criteria. Suppose that each ECDSA signature is generated by using the GLV method for point multiplication (...
7
votes
3answers
388 views

ECDSA signature verifiable 1-way transformations

Alice signs a message $m$ with her private key, yielding a signature ($r$,$s$). I want to prove to someone else that I have this signature, but I don't want them to have the knowledge of what ($r$,$s$...
1
vote
0answers
45 views

Caculated time One Point Multiplication with double and method

I am using double and add method for point multiplication in affine coordinates. How we compute 1PM in double and method? Di Wang said one point multiplication consists of repeated addition and ...
3
votes
1answer
90 views

What is the correct name for bytes which are to be signed?

I have some bytes, and I sign them with my private key using ECDSA. The resultant (71) bytes are the signature. But what is the name of the bytes I have signed? (If this were encryption, they would ...
0
votes
1answer
102 views

SHA1 collisions and the impact for ECDSA signatures

What will it mean for ECDSA using SHA1 when we have practical attacks breaking the collision resistance property of SHA1? [UPDATE] Added a bit more details to be clear. If $(r,s)$ is the ECDSA ...
13
votes
1answer
2k views

ECDSA Compressed public key point back to uncompressed public key point

From the ECDH demo here, if I generate a private key for Alice I can get _ P = 1175846487558108474218546536054752289210804601041 Which gives the following public ...
-1
votes
1answer
282 views

Should I use RSA encryption since RSA is said to be broken by NSA? [closed]

I am developing a simple web app that uses asymmetric encryption, but I am not sure whether to chose RSA for the reasons mentioned above. What are your suggestions? Also if I decided to go with RSA ...
3
votes
2answers
73 views

Are low security curves for ECDSA not supported?

I am working in a very bandwidth restricted environment, and we are looking to implement ECDSA digital signatures. Although they are no longer recommended, we might be looking to use curves that are ...
2
votes
1answer
104 views

Can I shorten the large ECDSA public key output file from OpenSSL?

I am working in a very bandwidth restricted environment where I from time to time have the need to distribute public keys. The distribution happens in bit format, so there is no need for encoding, at ...
0
votes
0answers
15 views

Are the ECDSA public keys of a stable/fixed length relative to curve size? [duplicate]

I am working in an environment with strict bandwidth requirements, and we need predictable bit lengths of the stuff we send. We need to broadcast ECDSA public keys, and we are using OpenSSL to ...
5
votes
0answers
99 views

Performance of ECDSA, ECKCDSA and ECGDSA

It is proven that ECDSA algorithms are faster in key and signature generation compared to RSA. In addition, the signatures are much shorter. However, I would like to know the performance difference ...
5
votes
1answer
1k views

How do RSA and ECDSA differ in signing performance?

Signature algorithms with elliptic curves have smaller output sizes compared to RSA for the same level of security. What about the processing time to generate a signature ? I've seen figures giving ...
8
votes
0answers
1k views

Elliptic curve cryptography related key attacks

This question is an extension of Families of public/private keys in elliptic curve cryptography As described above, bitcoin "type 2" deterministic wallets use a root private/public key pair, where ...
18
votes
1answer
668 views

How to provide secure “vanity” bitcoin address service?

Bitcoin addresses are RIPEMD-160 hashes of the public portion of a public/private ECDSA keypair (along with an abbreviated hash of the hash to provide a check code, as @pulpspy notes in a comment). ...
3
votes
0answers
51 views

Cost of attack on DSA with attack on DLP

Are there any (recent) estimates of cost of attack on DSA by solving the discrete logarithm? I'm especially interested in attacks that use Pollard's rho algorithm. Are there any optimized ...
0
votes
1answer
32 views

Why is it that in DSA, the order of the subgroup, $q$, is chosen such that it divides $p - 1$?

Consider the DSA key generation: A large prime $p$ is chosen; A smaller modulus $q$ is chosen such that $p - 1$ is a multiple of $q$; A generator $g$ s.t. $\operatorname{ord}_p(g) = q$ is chosen. ...
1
vote
1answer
28 views

What happens when domain parameter $q$ in DSA is not prime number

Suppose that attacker creates domain parameters $(p,q,g)$ where $q$ is not prime number (but $q$ still divides $p-1$) and that signer generates new key pair using these domain parameters. How exactly ...
4
votes
0answers
1k views

Reasons for Chinese SM2 Digital Signature Algorithm

In the IETF RFC draft named "SM2 Digital Signature Algorithm" a signature algorithm is specified. The RFC does however not mention why this signature algorithm has been defined. Nor does it specify ...
4
votes
1answer
98 views

Is there any reason not to use EdDSA with Weierstrass curves?

I'm volunterely working for a crypto library and we're planning on adding Curve25519 support (finally). At the same point I had the idea of adding support for EdDSA in the same run. Our library is ...
0
votes
0answers
211 views

How to verify a signature with openssl methods from the ECDSA class?

I'm trying to verify my signature like I explained in my question before. But I have some problems to program my own verification without the verify methods of openssl. Therefore I'm going on to use ...
1
vote
0answers
62 views

How to check the signature without the predetermined function in ECDSA from openssl?

I'm developing a client for a two-factor authentication in Qt/C++ under openSUSE 13.2, 64bit. I've got the FIDO U2F Security Key from yubico/fido. I'm using the classes from openssl, in particular <...
8
votes
2answers
950 views

HMAC vs ECDSA for JWT

I will be implementing JSON web tokens into my website and have a question about implementing them. I have a choice of using two algorithms, HMAC-SHA256 and ECDSA-SHA256. I have used HMAC-SHA256 in ...
2
votes
1answer
301 views

RSA vs ECDSA/ECDH

So we've been using RSA for a while now. I wonder, is it still secure? I'm wondering whether surveillance agencies can at this point read traffic encrypted with say, TLS_ECDH_RSA_WITH_AES_128_GCM? ...
0
votes
1answer
63 views

Is there a library-less implementation of DSA available to read? [closed]

Is there a pedagogical library-less implementation of DSA available to read? (Not ECDSA.) Obviously BigInteger and hash functions may be from libraries, but I want to read the implementation of all ...
2
votes
1answer
43 views

Is there a single-use signature scheme, where a second use of the private key discloses it to the world?

With ECDSA (and possibly DSA too) I'm aware that if the same value for $k$ is used with the same private key $D_A$ to sign two different messages, then anyone possessing the two messages $m_0$ and $...