# Tagged Questions

ECDSA is a signature algorithm. It is the elliptic curve (EC) implementation of the digital signature algorithm (DSA).

28 views

### How can a lattice attack be applied to ECDSA signatures?

The aim is to check if it is possible to break the ECDSA cryptosystem under the following criteria. Suppose that each ECDSA signature is generated by using the GLV method for point multiplication ...
42 views

### Converting ECC Code from python to Java. Extended Euclidean Algorithm not working. [closed]

I'm in the process of converting a Python program I found for calculating ECDSA public keypairs from a given private key. In this particular case it's on the Bitcoin curve. ...
30 views

### verify fails on 3rd party after signing with BouncyCastle

I am using BouncyCastle to perform ECDH and then encrypt the data between the mobile (Android) and my hardware with ECIES. It all works fine. When I try to sign a byte array and send it to the ...
48 views

### The difference in size between ECDSA output and hash size

So if I use secp256k1 for example, I've got my key size of 256 bit, and say I sign a SHA256 hash of a message, with size 256 bit, I get an output of size 512bit. Why is there a difference between the ...
197 views

### Elliptic curve brute forcing

I have elliptic curve of equation $y^2 \equiv x^3 -x$. And the coordinate of points $Q$ and $P$. I want to solve $Q=[k]P$ (where $k$ is the unknown) by testing all possible $k$. Is this the right ...
65 views

### Encoding a message to a point of curve y^2=x^3+7 and Bitcoin Core

Where should I look at in Bitcoin Core source code to figure out how the signature process trasform a message in a curve point? To sign a transaction (message) in Bitcoin system, you need to encode ...
83 views

secp256k1 (the signature scheme used by Bitcoin) has the interesting property that you can add two public keys to get a combined key that requires both private keys to produce signatures for. Is ...
40 views

### What does L_n is the bit length of the group order n states need for my calculation in ECDSA algorithm?

I am doing the program of implementing ECDSA for which I am trying to solve the equation scenario. In ECDSA that signature generation algorithm which states as hash value from the SHA-1 and where $l$ ...
68 views

### BER or DER X9.62 ECDSA signature

The signature format for ECDSA signatures can be encoded using ASN.1 integers according to X9.62 or it can comprise of two integers with the same size as the key size. In case the X9.62 format is ...
90 views

### How can ECDSA signatures be shortened (to be used as a product key)?

So I made my own serial key generation software, using ECDSA, for use in my own applications and it works great so far! To keep the serial key short enough I use a 128 bit EC curve. My final signature ...
120 views

### ECDSA for encryption

ECDSA keys are much shorter than RSA keys, but typically only used for signing, not encryption. Is there an accepted way of doing this? (https://bitcointalk.org/index.php?topic=196378.0 ...
84 views

### ECDSA Public key randomness

If I have a 256bit ECDSA public key how likely is it that the same public key will be generated by another person. Will it take on average 2^256 tries to generate same public key? If I xor the first ...
78 views

### Is changing $H(R\mathbin{\Vert}A\mathbin{\Vert}M)$ to $H(R\mathbin{\Vert}A\mathbin{\Vert}H(M))$ in EdDSA secure?

EdDSA calculates $s=(r+H(R\mathbin{\Vert}A\mathbin{\Vert}M)\cdot a)\bmod\ell$ and $r=H(h\mathbin{\Vert}M)$, with $H$ being the hash function (SHA2/512); $B$ being the generator; $A$ being the public ...
109 views

### Are there signatures that don't have subliminal channels?

Are there signatures that don't have subliminal channels and also don't require commitments or zero-knowledge proofs? DSA or Shorr signatures need a nonce which can leak valuable information. There ...
64 views

### request for data to test deterministic ecdsa signature algorithm for secp256k1

I’m implementing the RFC 6979 procedure to compute a message signature. I want to test my program on the secp256k1 elliptic curve. Note the “k” in secp256k1, i.e. the Koblitz curve. If you have the ...
344 views

### RFC 6979 - Why not simply hash the message & the private key for deterministic ECDSA?

Why go through the trouble of using the HMAC_DRBG process, instead of simply hashing [message | private key] to calculate $k$ for deterministic ECDSA? If the ...
173 views

### Verifying DER encoded DSA/ECDSA signature with extra content?

Having a DSA/ECDSA signature which is supposed to be DER encoded as an ASN.1 sequence of $r$ and $s$ (as described in the RFC), and being given some bytes which are ...
146 views

### Does the size of a ECDSA key determine the hash algorithm?

I am a bit lost in understanding what I read on authentication, signature, etc. For instance, is the size of the ECDSA keys produced by ssh-keygen -t ecdsa -b 256 ...
76 views

### Generating a public key certificate with ECDSA params

I have an ECDSA key generated in a HSM and I am able to retrieve it's public key components via the PKCS11 library. I would like to create a public x509 certificate with the public params for the ...
338 views

### Why is 224 bit ecdsa faster than 192 bit ecdsa?

I ran several benchmarks using openssl on 2 different computers and I got a surprising result. for the Nist 192 bit curve the benchmark result is ...
100 views

### Finding algorithm: desire RSA's uniqueness and ECDSA's space efficiency

I am asking for help in finding a signature algorithm with the following property: Given a message m and a private key prikey, ...
78 views

### How to calculate kinv from the given k value

I am implementing an ECDSA NIST test vectors verification application. The test vectors are taken from http://csrc.nist.gov/groups/STM/cavp/#09. One of the test vectors is given below: ...
43 views

### Selecting a Bouncy Castle named curve for ECC [duplicate]

I have been tasked with implementing ECDSA and ECDH in Java using the Bouncy Castle library. However, I am unsure of what curve to use. I am aware of the named curves listed in BC, and I've done a ...
672 views

### ECDSA with SHA256 and sepc192r1 curve: Impossible, or how to calculate $e$?

I need to use ECDSA as the signing algorithm and SHA256 for hashing the message. I'm running into troubles verifying the signature calculated on two different platform (one is BouncyCastle, another ...
481 views

### How does recovering the public key from an ECDSA signature work?

It is possible to recover the public key from an ECDSA signature (R,S). Please explain me how this works.
605 views

### What curve and key length to use in ECDSA with BouncyCastle

I'm developing a client/server system in Java which is not interacting with third party software, so I don't have to worry about compatibility. At a certain point, I need the client and server to ...
272 views

### Elliptic Curve based blind signature implementation

I want to use Elliptic Curve based blind signature scheme for my research. There is no proper implementation of ECC-based blind signatures. Can someone describe to me which things I need to follow ...
183 views

### ECDSA: How to retrieve a non-random k

I have a question regarding the random $k$ number of ECDSA encryption. As far as I know, it is possible to retrieve $k$ (and thus the private key) from two signed messages if both used the same $k$. ...
631 views

### Creating a license system based on asymmetric encryption (RSA or ECDSA)

I’ve spent a couple of days researching the topic of creating a license system for my desktop software. While I fully understand that there’s no perfect copy protection, this approach seems to have ...
1k views

### ECDSA vs RSA: Performance on Android platform and surprising results

For our privacy-preserving protocol, an encrypted channel is established. In order to protect our system from man-in-the-middle attacks, signature-based approach is used. After we've implemented it ...
657 views

### RSA and ECDSA performances

Signature algorithms with elliptic curves have small output sizes compared to RSA for the same level of security. What about the processing time to generate a signature ? I've seen figures giving ...
192 views

2k views

### ECC key size and signature size

My understanding of ECDSA signature length is that it depends on the key size. So for instance, if a "prime256v1" is used, the signature length will be 64 because (n/8)*2 and for "secp384r1" it will ...
168 views

### Where can I find examples of ECC implemented in VHDL?

I am looking into implementing ECDSA signature and ECDH key agreement in a Xilinx FPGA. All the examples I have found of VHDL implementations skip over how to construct the low level ECC primitives ...
746 views

### Signature algorithm SHA 1-2 with ECDSA

Can someone please explain what key sizes are required for the ECDSA algorithm? I tried a 128 bit EC Key for SHA1withECDSA and it throws an error. However with 256 bit key I could run the algorithm. ...
266 views

### Can Secp 256 K1 curves “map” to a value on FIPS 186-3 or P-256?

I'm looking at Secp 256K1 vs UProve's FIPS 186-3 or P-256 implementation. Is there any relationship between the curves such that I can consistently "map" or "project" values from one curve to ...