Questions tagged [hash-signature]
Signature schemes built out of and based on properties of hash functions. **DO NOT USE THIS TAG** if the signature is based on other hard problems and just happen to employ a hash function.
173
questions
-1
votes
0
answers
37
views
Code on medical referral in Germany [closed]
To get an appointment with a specialist faster in Germany, the general practitioner adds a code on the referral. You are only authorized if you can present this code. This code is called ...
-1
votes
0
answers
29
views
what is the difference between a hash function and a digest algorithm? [duplicate]
i know that digest is the ouput obtained from a hash function as well as from digest algorithm so does that mean hash function and digest algorithm are same?
0
votes
1
answer
42
views
How IKE authentication happens? what's the role of HASH_I & HASH_R, and how it gets verified by each parties? and where SKEYID_a gets engaged?
Dears,
In RFC 2409 "The Internet Key Exchange (IKE)", its mentioned there are four available authentication methods for IKE, there are different calculations for SKEYID for each method and ...
0
votes
0
answers
63
views
How to prove that signature hash is wrong without reveal message
Let's say we have Bob, Alice and third party.
Bob make message signature hash and upload to third party, then encrypt message with Alice pub key and send it to Alice
Alice receive message and decrypt ...
0
votes
1
answer
116
views
How does FORS: Forest of Random Subsets work?
I saw a post named "How does signing with FORS work in SPHINCS+?" but in the post it seems like no one had explain how does the FORS works.
SK: Secret Key, PRF: Pseudo-Random Function
I'm ...
0
votes
0
answers
30
views
Is hashing really enough for data integrity or needs signing? [duplicate]
Hashing functions are used for data integrity when integrated with signing asymmetric algorithms but I miss a step. In multiple sources like here or here I read for granted that hashing algorithm per ...
0
votes
1
answer
60
views
What are the statefulness and signature count limits of SPHINCS+?
SPHINCS+ is an interesting post-quantum algorithm, and I'm curious about what its limitations are. What I know about hash-based signature formats in the past are that you needed to remember which ...
1
vote
2
answers
2k
views
Why is SHA256 used as a layer on top of Digital Signature [duplicate]
Digital Signatures use an asymmetric algorithm, meaning that if I want to apply a digital signature to a document I sign it with my own private key and send it to the recipient.
The recipient, thanks ...
1
vote
1
answer
195
views
Cryptography to tackle deepfake, proving the photo is original
Deepfake technology has become very difficult to tackle due to sophisticated machine learning algorithms. Now, even when a journalist or bystander provides photo or video evidence, the culprit denies ...
0
votes
2
answers
228
views
NIST PQC: minimum number of digital signatures
I've been checking the NIST PQC documents to find the requirements about the minimum required numbers of signatures to be generated with a signature scheme:
NIST call for proposals
Call for ...
0
votes
2
answers
480
views
Best cryptographic method to distribute license files
I will describe my problem high-level, and not ask a very specific cryptographic question, since I am open for general suggestions as well. So in my question I will only speak about "security ...
1
vote
0
answers
24
views
Curious behavior of EVP_DigestSign for DKIM
Difficulties porting code to OpenSSL 3 may raise some doubts on digest signing. Before version 3 came, digest signing was the only way to use ED25519. On version 3, RSA_sign() being deprecated, I ...
1
vote
1
answer
61
views
What happens when a Merkle Tree OTS scheme runs out of keys
A Merkle Tree OTS scheme such as XMSS pregenerates 2^h keys that are tied to 1 public key
When the 2^h keys run out, does all the 2^h keys get removed/deleted and the device pregenerates another new 2^...
1
vote
1
answer
82
views
Regarding the Digital Signature Algorithm During Client Authentication in TLS 1.2
In TLS 1.2, when client authentication is carried out, digital signatures are utilized. However, at what point is the specific signature algorithm communicated to the server? It seems to me that the ...
0
votes
1
answer
62
views
Can I verify a message with Openssl if it was sign with .Net System.Security.Cryptography?
Sorry, this is sort of a beginner question.
But providing that it is possible to find the same options, can I verify a message with Openssl if it was sign with .Net System.Security.Cryptography ?
Let'...
1
vote
1
answer
45
views
PRNG to Obtain Random Subset (PORS) Success Probability
PORS (PRNG to ORS) is a secure variant of the HORS few-time signature scheme. In PORS, instead of using a hash function, it uses a message (and salt) as a seed of PRNG and query it until obtains k ...
2
votes
1
answer
124
views
Post-quantum EU-CMA security from OWF-only
In the paper: "Universal One-Way Hash Functions and their Cryptographic
Applications". The following is proven: "If 1-1 one-way functions exist, then the one-way based signature scheme ...
2
votes
1
answer
94
views
Bit flipping attack in hash function for message authentication
In this picture we have a use of a hash function for message authentication.
M is plaintext message. H is hash function. E is encryption block with K symmetric key. || is concatenation of plaintext M ...
2
votes
0
answers
385
views
How to hash a JWT signature using Public & private key (Have both key in JSON format & X.509 PEM Format), using ES256 algo for JWT
I want to hash my signature of JWT using public & private key, since we are using ES-256 algorithm in JWT. But the problem is that I have both the keys in JSON & .PEM format, so how can I do ...
1
vote
1
answer
887
views
best HMACSHA signed JWT secret length
I would like to use JWT but one thing I'm still thinking is ¿what is the best length for the secret?
If I'm using HS512 as a signing method the secret should have a length of 512 bits as far as I ...
1
vote
1
answer
57
views
LMS hash calls formula?
If we consider LMS with (SHA256 and LMS-OTS as the OTS scheme) as defined in sections 5 and 4 here:
https://datatracker.ietf.org/doc/html/rfc8554#section-5, they provide the following formulas for LMS-...
1
vote
1
answer
182
views
Code Singing Parameters for LMS/HSS/XMSS
LMS is specially used for applications, such as code-signing (https://csrc.nist.gov/CSRC/media/Publications/white-paper/2018/01/26/security-considerations-for-code-signing/final/documents/security-...
3
votes
1
answer
828
views
What is "one-time signature"
I'm studying the post-quantum cryptography (PQC).
While studying hash-based pqc, I read a thesis about Winternitz one-time signature scheme (W-OTS). What is the exact definition of "One-time ...
2
votes
1
answer
81
views
FORS and DFORS Few time signature Security level
I was reading the FORS and DFORS Few-Time-Signature scheme. I understood the security of HORS Few time signature equals to $ (rk/t)^k $, but I could not understand the security of FORS is $ (r/t)^k $ ...
0
votes
0
answers
83
views
Security proof of the Schnorr Signature
How Schnorr signature security can be proved for signature forgery, replacement, and Replay attacks?
2
votes
0
answers
33
views
If rabin signature uses a hash function then why cant we use that hash function to sign a message?
About Rabin Signature link
According to this paper, the person who wants to sign a message M first appends a random byte string U.
=> M_new = MU
Then uses a compression function to get c = ...
2
votes
1
answer
140
views
How to prove that two hashes correspond to the same original message, without using the message to verify?
Let's suppose this:
Message is "I love crypto.stackexchange.com" (M)
Bob creates hash H1 with the message M and his private key (Priv)
Alice receives a message X, and hash H2 with message X ...
0
votes
1
answer
84
views
LMS signatures : Complexity of Classic Merkle Tree Traversal
I'm trying to understand the complexity of computing the Merkle root for stateful hash based signature schemes. Section 4.1 of the chapter on hash based signatures in "Post Quantum Cryptography&...
0
votes
1
answer
184
views
Is it impossible to extract any data from an ECDSA signature of hashed data
I am trying to write a function that, given an EIP712 ECDSA signature, verifies the signature was signed by a particular person, and then (somehow) retrieves the information that is encoded in the ...
0
votes
2
answers
93
views
Is there any way to claculate the hash of (a + b +c)) if you only know hash(a) and Hash(b) and Hash(c)?
For example, if you have say, 3 distinct paragraphs of clear text a, b, c and you only know hash(a), hash(b) and hash(c), and then you have a clear text d, which claims to be the concatenation of a, b,...
2
votes
1
answer
110
views
Lattice-based Signatures and Hashes
Although many different lattice-based signature schemes exist, Hash and Sign signatures schemes, like [GPV08], are prevalent. On the other hand, it is well known that collision-resistant hash ...
1
vote
1
answer
152
views
Comparing stateful hash-based signatures to group-based signatures
Some applications may require quick transition to post-quantum signatures, and stateful hash-based signatures fill that role (cf. CNSA 2.0).
My question is (ignoring statefullness, focusing on space/...
-1
votes
3
answers
541
views
Which of the following is a reason to publish files' hashes?
To valiate integrity
or
To verify if the software is digitally signed
The question seems wrong to me. I do not see any reason to publish(make public) a hash. But it is in the material I am studying.
2
votes
1
answer
196
views
Zk Proof to Prove that I know the secret x of y = HASH(x)
Lets say I know a secret value x.
The hash of x, y = H(x) is public.
Is there any zk way to ...
0
votes
2
answers
103
views
Is there any Cryptographic loop function that returns first input?
I want to use cryptographic function that returns the initial input or something related to it like its hash, the function should work like Encrypting some data or its hash, then encrypt the output of ...
1
vote
2
answers
99
views
Generalized Haircomb OTS vs Winternitz OTS at 256bit hash security level
Suppose a 256 bit hash is used (SHA2, SHA3, ...).
How does the Winternitz OTS perform at various signature sizes?
I'd want to compare to a generalized K-teeth Haircomb:
It's signature is $K$ of these ...
-2
votes
1
answer
207
views
Why does the comb of Natasha Otomoski have 21 teeth? [closed]
What is the signature size of Natasha Otomoski haircomb? What is the number of invocations of the underlying one way hash function for key generation, signature, and verification?
How does it compare ...
3
votes
1
answer
143
views
Alter SPHINCS+ to have collision probability=0 and remove entropy source when signing
If you alter the SPHINCS+ signature scheme such that the number of signatures it can sign is the same as the number of hashes the hashing algorithm can output such that for example if you have a 2^256 ...
1
vote
1
answer
121
views
Stateful hash signature without Merkle trees
When it comes to stateful schemes, would you really need to use a Merkle tree?
Couldn't you sign the hash of the message concatenated to the hash of the new public key?
New public key: hash(hash(...
0
votes
1
answer
69
views
How come we only need to generate the first tree in each layer in XMSS MT
From what I understand, to reduce the time taken for public key generation, you can use nested trees in XMSS to form Multi-tree XMSS.
For an instantion of 2 layers, it seems that the leaf of each L ...
0
votes
1
answer
816
views
Signing a hash of file vs signing a file
If person A generated a hash (e.g sha256) of a file and then signed the hash using a private key.
Given person B only has the public key, file, signature and the hash, would verifying the signature ...
1
vote
1
answer
80
views
A CERTIFIED DIGITAL SIGNATURE paper pg 20 - 25
Reference paper: "A CERTIFIED DIGITAL SIGNATURE"
With reference to the image above which is from Page 20 of the attached paper. What is this new protocol that the paper speaks of here? What ...
2
votes
1
answer
212
views
Questions on "A CERTIFIED DIGITAL SIGNATURE" Pg. 19
Referenced paper here.
The above excerpt is from Page 19 of attached paper. I have a few questions.
y = F^9(x) is equivalent of F(F(F(F(F(F(F(F(F(x))))))))) ?
The excerpt says that this allows us to ...
2
votes
1
answer
321
views
Lamport Diffie One-time Signature
I am going through the Lamport Diffie One-time signature. I am having a hard time understanding
How can long messages (greater than 100 bits) can be mapped into short messages (100 bits) by a one way ...
0
votes
0
answers
125
views
Is there a cryptography algorithm for signing values with two keys and requiring both to verify it?
Is there an algorithm that lets me sign a value with two keys at the same time, and in turn requires both keys to verify the signature?
For instance, a scheme could work like this:
Sign X with Key1 ...
1
vote
0
answers
100
views
How to find strength of a cryptographic hash function?
I am having an idea to create a cryptographic hashing algorithm. I found a mathematical function $f: x \rightarrow y$ . By using Merkle-Damgård construction wide pipe, I designed a hashing function. ...
1
vote
1
answer
671
views
Why are WOTS and WOTS+ one-time schemes?
I've been doing some reading on hash based signature schemes, specifically XMSS and thus the underlying Winternitz scheme (WOTS+ to be precise).
As their names suggests, WOTS and WOTS+ are one time ...
1
vote
1
answer
161
views
Why do we need both bitmasks and keyed hash in SPHINCS+
I think one of them is related to multitarget attacks and the other is related to collision attacks. But I cannot find how hash based crypto related to hash collisions.
1-) Consider the following ...
2
votes
0
answers
86
views
Hash verification by key
I want to implement the following algorithm, but don't know what tools to use.
D - data
I generate some universal value for D - Y
I generate some random key - K, get a hash of D by this key - H
I ...
-1
votes
1
answer
144
views
Does sha256 is ok for that? If not does EC?
I think from what I studied that I had the correct reasoning, but I would like a double check. Here is the thing:
Given two matrix: A and B
I calculate the hashFunction(A, B) = C
Now I calcultate the ...