Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].

learn more… | top users | synonyms

3
votes
1answer
45 views

Proving property of Modified Rabin Signature

I'm trying to prove one of the properties of the “Modified Rabin Signature Scheme”: If $gcd(x, n) = 1$, then $x^{\frac{(p−1)(q−1)}{2}} \equiv 1 \pmod n$ This is what I’ve got so far… Proof Let ...
0
votes
0answers
3 views

Difference between pgp keys format? [migrated]

I am willing to spend some amount of time developing yet another license manager for desktop Java application. After some looking around I discovered JCPUID by Iakin that is free to use and should ...
1
vote
1answer
77 views

Using e-ID Number for Encryption and Digital Signing

I want to use e-ID number for performing Encryption/Decryption and Digital Signing - and in order to do so, I've opted a PGP-oriented approach which goes a bit like this. Generating PGP key-pair ...
7
votes
3answers
440 views

What is the advantage of digital signatures over message authentication codes?

Studying for CISSP these choices seemed limited: What is the advantage of digital signatures over message authentication codes? Digital Signature provides integrity verification while ...
2
votes
1answer
21 views

Winternitz Signature in standard model

I am studying the Winternitz signature and I describe its algorithms in the next W-OTS Key Generation. Select the parameter $w\geq 2$ that is the bit size of the partitions of the message to be ...
5
votes
2answers
68 views

Importance of random number generation in Schnorr's signature

In Schnorr's digital signature protocol (https://en.wikipedia.org/wiki/Schnorr_signature), the signing process (as described in wikipedia) requires the generation of a random bit $r$. I am wondering ...
8
votes
1answer
93 views

Could this “symmetric RSA” scheme provide key compromise resistant communications?

This question, and fkraiem's answer to it, made me wonder about the security and practicality of using "symmetric RSA" to provide a partially compromise-resistant secure channel. Specifically, assume ...
1
vote
1answer
28 views

setting the MGF hash to a different value other than the regular hash with openssl for PSS signatures

In PKCS1's Probabilistic Signature Mode you have the Hash and the MGF Hash. Both appear to be, by default, sha1, with the OpenSSL CLI client, however, I can change it to sha256 with the following: ...
1
vote
1answer
44 views

Can the original message be retrieved from a public/private key signature?

When I sign a message (which has potentialy low entropy) using a private key and I send it without the original message, can the original message be retrieved from the signature(s)? I want to prove – ...
4
votes
1answer
55 views

Compromise between HMAC and Digital Signature, by encrypting and sending secret key?

For achieving stateless authentication tokens (like JWT), is there a compromise between the performance of HMAC, and public key distribution of Digital Signature? Scenario: Sender is a centralized ...
6
votes
1answer
63 views

Choice of the one-way function (OWF) for Lamport signatures

I am studying the Lamport signature scheme, and I found that in many sources (eg: Hash-based Digital Signature Schemes) the input and output bitstring of the OWF and the message digest have the same ...
6
votes
0answers
109 views

Efficient way to confirm identity

I am working on a multiplayer game. I have a central server which handles all data transmission and coordinates all games. Clients which involved in a single session send requests to do actions to ...
9
votes
2answers
209 views

Why use Diffie-Hellman key exchange over RSA (or any public-key encryption)?

In Diffie-Hellman key agreement between Alice and Bob, Alice computes and sends $g^a$ to Bob, and Bob computes and sends $g^b$ to Alice. Alice then computes $(g^b)^a$, and Bob computes $(g^a)^b$; ...
2
votes
1answer
93 views

textbook RSA signature scheme security

Are textbook RSA signatures secure if an Adversary does not have access to ask signing oracle queries?
2
votes
2answers
51 views

comparison of security for identity based signature and Hashing (SHA-1) the identities

I would like to know which method can provide better security: using identity based signature or hashing the identities and message (using SHA-1) for authentication?
1
vote
0answers
24 views

NTRUSign Hashing

I have some trouble understanding the inner workings of NTRUSign. So what I have understood so far is, that when Alice wants to sign a message she does the following steps Convert Alice's message ...
1
vote
1answer
32 views

can session key be be used as digital signature?

if two communicating parties share a (symmetric) session key, k. When one of the party wants to send a message 'm' to other, is it okay use {m}k as a digital signature?
1
vote
1answer
58 views

Fast Forward Hash Signatures

As a follow up to the Q/A session: Small Quantum Signatures - Reality check needed I have implemented the discussed idea for a new short-quantum-safe signature system using fast-forwarding hash. It ...
0
votes
1answer
44 views

Doubts about Authenticated Data Structures logic

I am studying the theory of authenticated data structure, like Merkle Tree and I have a doubt: why use them? I explain better: why to be sure, for example, that a cloud provider didn't modify my files ...
0
votes
0answers
32 views

How all necessary parameters are shared between signer and verifier in ED25519 signature scheme?

I am a newbie in cryptography. I want to use ED25519 signature scheme in my application which requires frequent sharing of secret data between two entities in public domain. I know that Schnorr ...
3
votes
1answer
131 views

Checking the integrity of RSA public key

Let's say I need to verify a digital signature and the public key is stored in untrusted storage which I need to fetch before I verify the digital signature. However, I can store the cryptographic ...
1
vote
1answer
69 views

Which hash function is usually used in RSA?

I know there are several available, however I can't seem to find whether there is one standard one or not. I think I understand the process of digital signatures, just wondering which has function is ...
4
votes
0answers
52 views

How to use a stream cipher to sign a message?

Are there known constructions which allow to sign a message M (let's say it will be sent as clear text) using a stream cipher C and a symmetric secret key K? So, we have M, C, K and we want to send ...
1
vote
0answers
36 views

How to check the signature without the predetermined function in ECDSA from openssl?

I'm developing a client for a two-factor authentication in Qt/C++ under openSUSE 13.2, 64bit. I've got the FIDO U2F Security Key from yubico/fido. I'm using the classes from openssl, in particular ...
2
votes
1answer
96 views

Signing/verification between Java and the OpenSSL

I'm trying to sign/verify data between a C application and a Java application. In java for now I was using the built-in JCE provider with SHA256withRSA as ...
0
votes
0answers
16 views

Encrypted vs unencrypted digital signatures [duplicate]

Is there a difference in terms of security between An encrypted stream of bits obtained by encrypting a plaintext concatenated with it's signature $ C = E_k(plaintext||\sigma)$ where $E$ is a ...
0
votes
0answers
48 views

How to sign an elliptic curve point using an ECC signature scheme?

In Schnorr based ECC signature scheme, a message $M$ is signed with the private key $\mathit{sk}$ as $$s=\mathit{sk}\cdot h(M,R)+k$$ where $R=k\cdot P$ and $P$ is a base point. If $M$ is a point ...
1
vote
0answers
14 views

Remotely Verify File Timestamp

I'm working for a professor to build a platform for students to take midterms and finals online. The student downloads the test during class (when the professor makes the test available on the server ...
2
votes
0answers
55 views

EdDSA Verification vs. Cofactorless Verification

In the EdDSA for more curve paper the authors defines: Keys An EdDSA secret key is a $b$-bit string $k$. The hash $H(k) = (h_0, h_1, ... , h_{2b−1})$ determines an integer $s = ...
2
votes
1answer
32 views

Is there a single-use signature scheme, where a second use of the private key discloses it to the world?

With ECDSA (and possibly DSA too) I'm aware that if the same value for $k$ is used with the same private key $D_A$ to sign two different messages, then anyone possessing the two messages $m_0$ and ...
3
votes
0answers
25 views

Is there a standard notation for a message concatenated with its signature?

I'm wondering what's the standard (or canonical) notation for "a message along with its signature", i.e. $$ \mathit{Message}~\Vert~\sigma_k(\mathit{Message}) \text. $$ Here the duplicated ...
3
votes
3answers
666 views

Is it usual for a signed message to contain the public key of the signer?

In protocols/systems which use ECDSA, is it common for the message to contain the public key of the message signer? If not, how do recipients know that the message has been signed by the correct ...
3
votes
1answer
80 views

What is the correct name for bytes which are to be signed?

I have some bytes, and I sign them with my private key using ECDSA. The resultant (71) bytes are the signature. But what is the name of the bytes I have signed? (If this were encryption, they would ...
1
vote
2answers
98 views

Is signing a plaintext sufficient?

If I have N bytes of plaintext, does signing it with my private key prove (to holders of my public key) that I have signed that exact plaintext messages? i.e. could an attacker use the plaintext and ...
5
votes
0answers
37 views

Is it possible and safe to use SAKKE for signing/verification, rather than for encryption?

Is it safe to use the Sakai–Kasahara key encryption algorithm (SAKKE) for signing/verification, rather than for encryption? (Example at bitbucket.org) In particular, I want many Bobs to be able to ...
2
votes
2answers
63 views

How do you communicate the hash function used with RSA signing?

When it comes to RSA signing, I understand why you need to hash the data before signing it, but don't you need to communicate what hash algorithm you use to whoever will need to verify the signature? ...
5
votes
0answers
46 views

Can a one-way accumulator be used in place of a digital signature?

Could a one-way accumulator be used in a manner to replace a digital signature? Can it provide a way to: verify that the data has not been tampered with, and verify that the message is in fact ...
2
votes
0answers
40 views

Signing integers and UUIDs and restoring them from a third party server without tampering

I'm educating myself about cryptography. I know this is a long one, but please, bear with me. :) Now I have a scenario in my mind and I'd like to ask if what I've thought is sound (enough), what more ...
4
votes
1answer
94 views

Are EC public/private keys significantly weakened by having a known byte?

I would like to use different EC keys for different purposes in an app, and I would like to easily see the purpose for which particular key (pair) was generated. With ~65K attempts, I can generate a ...
8
votes
1answer
210 views

Signature to prove of ownership of arbitrary sized data

I am familiar with public key signatures, but I was wondering if there is a method to accomplish the following. Suppose I publish a file (say a PDF article) on a peer to peer network. How can I ...
2
votes
2answers
102 views

(Lightweight) Multicast one-way Authentication

Problem: I'm thinking about a lightweight solution to provide source authentication (only one source) to multiple receivers (multicast message). Context: Taking the problem to ground, we can think ...
2
votes
0answers
41 views

How to prove that a commitment hides the decryption of an ElGamal ciphertext?

I've decided to remove a previous unanswered question of mine and break it down into smaller pieces so it's not such a loaded question. For this question I need to prove that I've committed to a ...
4
votes
2answers
260 views

Is there a difference between asking for a signature and asking for a decryption in challenge-response authentication?

Consider the following two authentication schemes. In both cases the server knows a public key of the client (for a signature system in the first and an encryption system in the second case). Scheme ...
0
votes
0answers
53 views

Detecting Software Changes - Verifying untampered code

This question assumes an environment devoid of any internet connections, the software in questions operates in a non-connected environment on a single machine. I have a piece of software that may be ...
2
votes
1answer
158 views

RSA Signature Verification Implementation on Cortex M0

I have to implement RSA Signature Verification procedure (RSA-2048) on a Cortex M0 based MCU. My budget is 15kB Flash and 2-4kB Flash RAM. Is it even possible to do RSA on a low end MCU based on ...
4
votes
1answer
63 views

Should the signature be prefix or postfix to the message in the sign-then-encrypt scheme?

Let's assume we have a message $M$ and it's signature $S$ and that $|$ is the concatenation operator. Should we encrypt $S|M$ or $M|S$? Does it even matter?
2
votes
1answer
121 views

Very short signatures? (eg: 48bits?)

Our application requires some 'mild' form of 'proof of origin' for the tokens we issue (~200 bytes), however, the value of each is trivial. The requirement is to provide 'tamper resistance' rather ...
2
votes
1answer
110 views

Wanted: Simple ring signature example

I spent all day trying to figure ring signature schemes out but apparently I wasted time. I read the original ring signature paper (Rivest's How to leak a secret). I'm having numerous problems. Let's ...
2
votes
1answer
158 views

RSA 1024 bit forge a new matching signature from a chosen message

I have an RSA signature scheme with 1024-bit key where I know the following: Public modulus $N$ Public exponent $e=3$ A lot of signatures Summary: To compute a signature, an MD5 hash is ...
0
votes
1answer
50 views

How can I prove I have a certain Facebook account by signature?

I would like to know how to prove I have certain Facebook account (or that I can login to that account).