Hash-based digital signatures, such as Lamport one-time signatures, are digital signature schemes based on a (non-trapdoor) one-way function such as a cryptographic hash. Such schemes are expected to remain secure even against attacks using quantum computers.

learn more… | top users | synonyms (1)

8
votes
3answers
2k views

Lamport signature: How many signatures are needed to forge a signature?

Lamport signature: Signing the message Note that now Alice's private key is used and should never be used again. The other 256 random numbers that she did not use for the signature she must never ...
7
votes
6answers
2k views

Why MACs are so important despite digital signatures doing everything a MAC can do and more

When an entity A wants to send a message to entity B, he can attach a MAC to the message. Entity B on receiving the message can use the pre-shared key to compute the same MAC and confirm if the ...
6
votes
3answers
536 views

Stateless hash based public key cryptography?

Merkle-Winternitz signatures based on fractal hash trees are an attractive alternative to other post-quantum cryptographic schemes, in particular since they are conceptually simple, the security ...
6
votes
3answers
533 views

One-time digital signatures

Are there digital signatures for which, given two documents signed by the same key, one could derive the key? With such one-time signatures, one may be able to design a cryptocurrency based on proof-...
5
votes
1answer
79 views

Choice of the one-way function (OWF) for Lamport signatures

I am studying the Lamport signature scheme, and I found that in many sources (eg: Hash-based Digital Signature Schemes) the input and output bitstring of the OWF and the message digest have the same ...
4
votes
2answers
87 views

Importance of random number generation in Schnorr's signature

In Schnorr's digital signature protocol (https://en.wikipedia.org/wiki/Schnorr_signature), the signing process (as described in wikipedia) requires the generation of a random bit $r$. I am wondering ...
4
votes
2answers
2k views

Difference between salted hash and keyed hashing?

A cryptographic salt is additional input other than message itself for a hash function so that it prevents attacker from launching dictionary attacks . Usually the salt is stored along with the hash ...
4
votes
2answers
884 views

Winternitz One-Time Signature

I am reading the page 38 in this "Post Quantum Cryptography" book (Equations 8 and 9). My question is, why to compute the verification key $Y$, $f$ is applied $2^w-1$ times? Are there any security ...
4
votes
1answer
112 views

What security do digital signatures provide (like used when signing PDFs)?

I want to ask you one question about digital signatures as they are (for example) used when digitally signing PDFs. We know that if our document has a digital signature, we can detect if the original ...
4
votes
1answer
72 views

Do other one-time signature schemes exist?

I'm curious to know if there are any one-time signature schemes other than Lamport's or its variants (Merkle trees are one such variant). The first I've discovered is called "Bins and Balls" which ...
4
votes
1answer
160 views

Determining if Server/Client's TLS configuration is Vulnerable to SLOTH

In the context of SSL/TLS protocol and SLOTH vulnerability. I want to find out if certain websites(webservers) or applications that use TLS are vulnerable. I need some guidance for this. My idea is ...
3
votes
2answers
137 views

Small Quantum Signatures - Reality check needed

I've been thinking a bit lately about how to get quantum resistant signatures fast and (relatively) small. One idea I've been keen on exploring is finding a crypto PRNG that allows fast-forwarding, e....
3
votes
2answers
128 views

Strange MAC algorithm

I'm working with a payment provider which uses the following algorithm for signing messages: The merchant is securely given a secret key k, known to them and the ...
3
votes
3answers
359 views

Can one use a Cryptographic Accumulator to efficiently store Lamport public keys without the need of a Merkle Tree?

One of the problems of one-time Lamport signatures is that public keys are disposed after use, so you must generate many keys and store them in a Merkle tree. The root is the "real" public key and ...
3
votes
2answers
319 views

Proof that a hash matches an encrypted file

Assume that Alice has a file $F$ which she is going to send, in encrypted form to Bob. Alice possesses $F$ and an encryption key $K$. She sends to Bob the encryption of $F$ using $K$, $E(F,K)$ as ...
3
votes
1answer
326 views

A fast non-cryptographic hash function that is “strong enough”?

I'm designing a simple one-time-password mechanism for authentication against a possibly-insecure server - i.e. I don't want to use symmetric shared secrets. The first idea that came into mind was ...
3
votes
1answer
327 views

Quantum resistance of Lamport signatures

The Lamport-Diffie signature scheme is said to be quantum-resistant. Why is that? What would a quantum attempt to attack this signature scheme look like, and how does it fail?
3
votes
1answer
183 views

Attack on DSA modification with bad hash function

Given a (bad) modification of DSA where the hash function is the identity ($H(m)=m$), I am now supposed to design an attack. So $(m, (r,s))$ are given and I should be able to create a legit signature $...
2
votes
1answer
523 views

Does the size of a ECDSA key determine the hash algorithm?

I am a bit lost in understanding what I read on authentication, signature, etc. For instance, is the size of the ECDSA keys produced by ssh-keygen -t ecdsa -b 256 ...
2
votes
1answer
2k views

Certificate signature with SHA-1 and RSA: where do 1888 bits come from?

Plenty of X.509 Certificates use "PKCS#1 SHA1 with RSA encryption" as the Certificate Signature Algorithm for generating a 2048-bit signature. The SHA-1 hash function generates a hash value of 160 ...
2
votes
2answers
123 views

Digital Signature Attack

In a typical digital signature scheme in which in order to sign we compute: hash of the message: $h(m)$ resulting hash signed with the private key $[h(m)](private key)$ If there were a collision ...
2
votes
1answer
467 views

Hash collision resistance requirements for Lamport signatures

According to the original paper, Lamport one-time signature scheme uses two one-way functions: $F$ and $G$. The former one, $F$, is used to create a public key by hashing elements of the private key (...
2
votes
1answer
118 views

Proof of shared secret through key derivation

Alice gives a random key $K$ (e.g. 32 bytes long) to Bob through a secure channel. Bob want to prove to Alice through an unsecured channel that he knows the key. Is it secure for Bob to send $s||...
2
votes
1answer
338 views

What is a Trapdoor in Merkle Signature?

Merkle signature (pag. 40) use than public key (verification key) the root of the Merkle Tree and than private key (to sign) the set of pre-images of the $g(Y_i)$ where $Y_i$ is the verification key ...
2
votes
2answers
696 views

PGP digital signature vs SHA256 HMAC Comparison

First let me admit that I am not a mathematician or a cryptographer. I am responsible for assisting in making a recommendation on a project that is consolidating payment processes within a company's ...
2
votes
1answer
296 views

Is ed25519 a “hash signature”

Writing my last question, I saw the hash-signature tag. I tried to research it best I could, but I'm simply overwhelmed in this field. I don't think it means to simply hash data before signing, but ...
2
votes
1answer
214 views

Is it necessary to use single hash function for signature generation and HMAC?

I am trying to figure out if we need to use single hash function across all the places in a ssh session. i.e – signature generation/verification and HMAC calculation/validation. Is it possible to use ...
2
votes
1answer
130 views

Usability of padding scheme in blinded RSA signature?

In Wikipedia's article on Blind signature, in the section Dangers of blind signing which describes RSA blinding attack one reads the following This attack works because in this blind signature ...
2
votes
1answer
53 views

Why are the bit lengths of keys and digests equal in Lamport signatures?

In Lamport's one time signature scheme: One way function to convert a pseudo random number private key to a public key takes $\{0,1\}^n$ and returns $\{0,1\}^n$. Cryptographic hash function to ...
2
votes
1answer
135 views

Generate hash value using public key along with message

I was trying to understand one way signature chaining on message by Saxena and Soh. As the message is passed from one user to other, every user can combine their signature to create one single ...
2
votes
1answer
82 views

ASCII input to HMAC weaker than raw bytes?

In various cryptographic programs I've written (most have been toy problems, but this current one is not) I have taken a slothful approach to performing a message digest (hash) of numerical input. I ...
2
votes
0answers
70 views

how to verify subset of hashes from hash list

I need to verify a couple hashed (SHA256) integers from a list of approximately 50 hashed integers in a message. The list can be divided into groups. The (plain) integer data is not in the message, ...
1
vote
1answer
180 views

Merkle Signature Generation

In the section 2 (page 42) of the book "Post Quantum Cryptography", it says: Then he generates the one-time signature $\sigma_{\text{OTS}}$ of the digest using the $s$-th one-time signature key $...
1
vote
2answers
103 views

Lamport-Diffie + attempting to invert OWF

I am studying Lamport-Diffie signature scheme and in my lecture present the follow algorithm for attempting to invert the one way function $f$, where $f$ is used to compute the public key of this ...
1
vote
1answer
46 views

Is it possible to brute force a single smaller variable in $\operatorname{HMAC-SHA512}(k, a\ ||\ b\ ||\ c\ ||\ d)$?

Given $c' = \operatorname{HMACSHA512}(k, a\ ||\ b\ ||\ c\ ||\ d)$ and the 32-bit integers $a$, $b$, $c$, and $d$ is it feasible to alter $b$ and produce a valid MAC under the unknown key? I ...
1
vote
2answers
55 views

Merkle signature scheme

I was browsing the Wikipedia article on Merkle signature schemes and noted that it says: The number of possible messages must be a power of two[…] Why is that? ...
1
vote
1answer
397 views

Security of chameleon hash functions

With the knowledge of the trapdoor, we are able to compute the same digest for differents messages. I've read that given two messages $m$, $m'$ and two numbers $r$, $r'$ such that $Ch(m,r)=Ch(m',r')$...
1
vote
1answer
55 views

How is the base64 encoded signature in Craig Wright's proof constructed?

Mr. Craig S. Wright might be Satoshi Nakamoto - the inventor of bitcoin. He is currently proving the case. But how is the base64 encoded proof, that is published by himself on his blog post ...
1
vote
1answer
147 views

Is it ok to send part of digital signature if we have bandwidth constraints?

When creating digital signatures is it ok to send part of it when we have bandwidth constraints?
1
vote
1answer
260 views

Lamport-Diffie + Security Proof

I am studying Lamport-Diffie signature scheme. In the lecture present the algorithm $A'$ for attempting to invert the one way function $f$, where $f$ is used to compute the public key. My question is ...
1
vote
2answers
219 views

How is message length involved in public/private-key encryption?

I've just read this question regarding why to sign only the hash of a message. I kind of understood the answer, but the question arisen is now: Why can I encrypt any text messages with the same ...
1
vote
1answer
61 views

Signature Verification: High level

I'm trying to understand how certificate signing and verification works conceptually. I know the classic example with asymmetric cryptography- the sender encrypts data with public key of receiver, ...
1
vote
1answer
88 views

collision resistant summarizer for long hash values

how we can summarize SHA-256 into shorter values when we for example can't handle more than 128 bits on system? its better just use first 128bit and ignore the rest of bits or split full value and XOR ...
1
vote
1answer
107 views

Hashing - Digital Signing and Trivial Stretching

Two very basic questions: 1. Digital Signing Why is it not possible to just simply replace the hash value from the request? Examples: ...
1
vote
0answers
86 views

Corporate PKI - SHA1 deprecation [closed]

Here is the context. Suppose you have a corporate PKI with : AC_Root (offline in safe store - SHA1 signature) SubRootA ans SubrootB (offline in safe store - SHA1 signature) SubSubRootC, SubSubRootD,...
1
vote
2answers
364 views

Signing a document: which algorithm to use?

What I want to do is to digitally sign a document. I am new to cryptography and was wondering what issues to take into account. The only criteria is that a textual document signed should produce a ...
1
vote
0answers
97 views

Factorization or discrete logarithm is difficult for an attacker?

I have read that difficulty in breaking many algorithms are based either on Factorization or discrete logarithm. I am reading about schemes that are similar to RSA which make use of integer ...
1
vote
1answer
270 views

Collision attacks on digital signatures

After reading this document about MD5 collision attacks, I still don't understand how collisions can make digital signatures insecure. In the paper, the researchers created two files with the same ...
0
votes
2answers
184 views

Convert SpookyHash to semi-secure 192bit hash [closed]

What do you think of converting SpookyHash into semi-secure 192bit hash function by this way: increase security by using 8 * 8byte = 512bit blocks instead of 8 * 12byte blocks, but remaining 8 * ...
0
votes
1answer
160 views

1024 RSA Hash Signature attack. Forge a valid signature

I have an RSA signature of 1024 bit where i know the following: Public modulus N Public exponent (0x03) Cypher message Summary: An MD5 hash is calculated from a collection of byte and is used as ...