Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].

learn more… | top users | synonyms

0
votes
1answer
64 views

Proof for composed signatures

Assumes that we have 3 signature algorithms, $S^A$ with key pair $(sk^A,pk^A)$, $S^B$ with key pair $(sk^B,pk^B)$,$S^C$ with key pair $(sk^C,pk^C)$. We denote by $\epsilon$, $\epsilon'$ and ...
1
vote
2answers
98 views

Efficiently map $2^n$ unique 64-bit vectors to $2^n$ $n$-bit vectors where $n < 64$? [on hold]

Is there an efficient way to map $2^n$ unique 64-bit vectors to $2^n$ $n$-bit vectors where $n < 64$?
8
votes
1answer
129 views

Proof of Communication

I desire an algorithm in which Alice sends a block of data $X$ to Bob, with proof that the data was both sent and received. Ideally this would take the form of a public-key signature of the block $X$ ...
3
votes
2answers
195 views

Rely on NSA Suite B Cryptography?

NSA's Suite B Cryptography suggests some cryptographic algorithms for encryption, digital signatures, message digests and key agreements. The selected algorithms and their key size are suggested by ...
-2
votes
1answer
32 views

How does the signature checking work in DKIM?

As far as I understand DKIM works like this: DKIM is not used to encrypt anything, the only purpose is to mark mails that are not really sent from the claimed domain as spam. the DKIM-enabled ...
1
vote
1answer
60 views

Verification of signed message with encryption

I have a question about the message that is being encrypted and signed. Say, two users called Tom and Mary, both have a pair of private key and public key. Tom sends a message through a system that ...
4
votes
1answer
190 views

What characters are valid in PGP encrypted and signed messages?

What characters may be present in a PGP encrypted message or a PGP signature? For example, do encrypted messages only use the Roman alphabet + some numbers and symbols? Can the character set be ...
1
vote
1answer
133 views

A way around digital signatures?

Scenario: I have to protect the integrity of some files that will be exchanged between entities $A$, $B$, $C$. Entity $A$ creates the file (e.g. configuration) and sends it to $B$ and $C$. Entities ...
4
votes
1answer
118 views

Implementing CD serial key system

I am trying to create a system where to unlock the application one needs to enter a serial code. I have read many articles on the theme but there are two problems bugging me. One is, If I have a ...
2
votes
2answers
147 views

What curve and key length to use in ECDSA with BouncyCastle

I'm developing a client/server system in Java which is not interacting with third party software, so I don't have to worry about compatibility. At a certain point, I need the client and server to ...
3
votes
1answer
104 views

What is the quantum-resistant signature scheme with the smallest signature + pubkey?

After playing cat and mouse with an number of quantum-resistant signature schemes and coming up with nothing with small enough signatures, I'm turning to Crypto.SE. I need a quantum-resistant ...
6
votes
2answers
108 views

Is there a way to compress multiple signatures of the same data?

So, I'm working with a system that allows individual users to each have their own private-public key pair. I would like to allow multiple users to use their private key to sign the same piece of ...
2
votes
0answers
65 views

Is it possible to perform a rudimentary asymmetric key encryption algorithm by hand?

I have at least three, distinct motivations for having a simple way to use asymmetric key encryption by hand or without modern computers. First, I was recently demonstrating to a 12-year-old how ...
3
votes
1answer
137 views

Description of signatures with message recovery (as in ISO/IEC 9796-2 and EMV Signatures)

I'd like to get an overview of how the signatures with message recovery work, especially in case EMV and other smart card systems. Is there a nice overview available without being required to read the ...
3
votes
2answers
132 views

What are good combinations of public key algorithms or primitives for long term security?

There has been talk in literature about doing multiple encryption with different block ciphers or stream ciphers several times before, and the benefits and risks of such efforts. There may be hidden ...
3
votes
0answers
76 views

Compact digital signature for noisy data

The question asks for a signature scheme, with a public verification procedure, that is tolerant to minor alterations of the signed data during its transmission [possibly in analog form over some ...
1
vote
1answer
65 views

How can a digital signature algorithm incorporate a random data if it is to be authenticated on a separate system

I am trying to understand how RSA digital signatures can incorporate any data from a PRNG into the final signature. Does this mean that separate implementations might fail to verify each others ...
3
votes
2answers
102 views

Is ”generating transcripts that are indistinguishable from actual messages in a signature scheme” not universal forgery?

In the Pointcheval paper “Security arguments for digital signatures and blind signatures”, they have proved the security of Schnorr signature for existential forgery under adaptively chosen-message ...
2
votes
1answer
327 views

Precomputation attacks on RSA

Are precomputation attacks - such as outlined in RFC 3610 chapter 5 - possible on RSA PKCS#1 v1.5 signature generation? If yes, are such attacks taken into account when calculating the cryptographic ...
3
votes
3answers
163 views

Does ECIES imply authenticity?

Assume: Alice and Bob both generate separate EC keypairs Alice obtains Bob's public key, and together with her private key creates a shared secret key Alice encrypts a message using the shared key ...
1
vote
1answer
65 views

ElGamal digital signature. why mod p-1 in delta?

Im trying to figure out why $\delta$ in the signature part of ElGamal has mod $p-1$ when $\gamma$ has mod $p$? $\gamma = \alpha^k \mod p$ $\delta = (x-a\gamma)k^{-1} \mod p-1$
1
vote
1answer
88 views

Ed25519 with R replaced by H(RAM)?

Ed25519 signatures consist of $(R, s)$, where $s = r + H(RAM)a$ $mod$ $l$, and $R = rB$. This differs from the Schnorr signature where instead of $R$, the signature contains the hash $h=H(RAM)$. ...
0
votes
1answer
115 views

Is this EdDSA modification secure?

I am hoping to employ a signed set membership system which is valid iff each signer's contribution to the set is present. The system should allow for two or more mutually exclusive signed sets to be ...
1
vote
0answers
57 views

The advantages of Merkle Signature and One time Signature

In Merkle Signature, it also requires one-time signature to be used once for a message. The signature in Merkle scheme is even longer compared to Lamport one time signature. The verifier also has more ...
1
vote
1answer
112 views

Group Signature Scheme without Opening but with Revocation

After reading many papers about group signature schemes, I saw that basically all of them employ the possibility of "signature opening": The Group Manager (GM) can identify any signature made by his ...
4
votes
1answer
166 views

Proving the possession of signature in zero-knowledge

Does anybody know an efficient mechanism to prove the possession of a digital signature (e.g. RSA) on a certain attribute (message) in zero-knowledge? That is, without revealing the actual signature ...
3
votes
1answer
123 views

Security benefits of Ed25519 generating signatures deterministically

I am reading on the Ed25519 curve, and I am trying to understand a claim. Here is the claim: Foolproof session keys. Signatures are generated deterministically; key generation consumes new ...
1
vote
1answer
71 views

Is there an anonymous non-interactive authorisation scheme with peer-side auth. signature generation?

I implemented a pseudonymous PKI scheme (by K. Zeng @Springer Link), where all peers can change their public keys including its signature on their own. I am looking for a way to extend it with some ...
1
vote
2answers
107 views

Is RSA encryption the same as signature generation?

Is performing RSA encryption with the private key identical to performing RSA signature generation (signing)?
1
vote
1answer
50 views

Showing that security of a elgamal invariant is insecure

Original Elgamal signature is defined $S(m, \alpha) = (r, s)$, where $$r = g^k \bmod p$$ $$s = (m – r*α)k^{-1} \bmod (p – 1)$$ more information on Elgamal signature can be found here. Variant ...
3
votes
1answer
148 views

Given a message and signature, find a public key that makes the signature valid (ECDSA)

This question is a variant on Given a message and signature, find a public key that makes the signature valid, which discusses the analogous question for RSA. It was suggested to me by this post over ...
2
votes
0answers
77 views

Threshold signatures vs. certificate authority+voting verification

Perhaps a silly question, but I am wondering what the advantages are of threshold signatures. Let's consider the following two signature schemes: $(t,n)$-threshold signature with a trusted dealer, ...
2
votes
1answer
98 views

Why do we encrypt-then mac but sign-then-encrypt?

This question was asked in comments on my answer to should we sign then encrypt or encrypt then sign. I think posing the question as a separate entity is best, so: The general advice for applying ...
0
votes
0answers
52 views

How to know private key is computed from specific partial private key?

In a certificate-less cryptography, I have learned that – to resolve the key escrow problem of IBE – the concept of a partial private key is used. Now, consider the following Scenario: After ...
1
vote
0answers
63 views

Is there a malleable pubkey digital signature scheme?

I'm trying to find a special kind of Digital Signature Scheme. The scheme should allow me to transform a signature $s=\text{sign}(sk,m)$ (for a private key $sk$ and a message $m$) into a signature ...
0
votes
2answers
112 views

Convert SpookyHash to semi-secure 192bit hash [closed]

What do you think of converting SpookyHash into semi-secure 192bit hash function by this way: increase security by using 8 * 8byte = 512bit blocks instead of 8 * 12byte blocks, but remaining 8 * ...
4
votes
4answers
211 views

What is the difference between authenticating and signing a document?

Authenticating a document means to verify it is from the sender. But it seems like signing a document also verifies it’s from the sender. What exactly is the relationship or difference between ...
1
vote
0answers
69 views

How to compare different signature scheme's performance?

I am interested in comparing the computational performance of two signature schemes. However, I am unsure how to do that. My candidates are RSA and Shamir's ID Based Signature scheme. To get a fair ...
1
vote
2answers
277 views

How do I create a short signature? (e.g. less than 100 bytes)

I want to put information into a QR code and have it signed so that the authenticity of the information can be verified. But QR codes have limited storage capacity and when I used e.g. gpg I get ...
5
votes
1answer
198 views

Is it possible to weaken a bitcoin private key by “using” it elsewhere?

What are the increased possibilities (if any) of being able to crack a private key given the following: The associated bitcoin (ECDSA Secp256k1-based) public key is known. The private key has been ...
2
votes
1answer
176 views

Why the need to hash before signing small data?

I’ve got two questions: I’m doing the following: Data : uuid + int + nonce Signature: ECDSA(sha256(Data) ) To verify the signature: ...
2
votes
1answer
46 views

ECDSA signature verifiable 1-way transformations

Alice signs a message $m$ with her private key, yielding a signature ($r$,$s$). I want to prove to someone else that I have this signature, but I don't want them to have the knowledge of what ...
1
vote
0answers
38 views

Distributed authentication in low trust environment

I would like to inquire if there is any Method to achieve the following: There is a list $L$ of $n$ entities that are allowed to perform a certain action. $L$ is cryptographically signed by some ...
2
votes
0answers
78 views

Looking for a detailed example of proof by reduction

I'm looking for a very detailed example of proof by reduction. Say we have two or three protocols (that have been proven secure) and we construct a new protocol. We want to provide a proof of security ...
1
vote
1answer
87 views

how to use salt to sign a message and how is it effective? [duplicate]

I've had an assignment to sign a file using hash and salt, so I read about salt and I got why it's important when it comes to password, but not to sign messages. How do I sign something using salt? ...
3
votes
1answer
219 views

Why does Openssh use only SHA1 for signing and verifying of digital signatures?

I am learning SSH protocol. With my current understanding of SSH protocol, I think that message digest algorithms for using in digital signature should be derived from Key Exchange. But Openssh ...
3
votes
1answer
100 views

Should different key pairs be used for signing and encryption?

In the recent iOS Security white paper from Apple (February 2014), the section on iMessage discusses using two different asymmetric key types as part of its standard operation: When a user turns ...
1
vote
4answers
131 views

Are there use cases where a signature itself needs to be signed?

I'm writing some code to digitally sign certain files (JSON, if you must know), and I'm trying to understand the use cases, not being a crypto guy myself. I understand there are use cases where ...
2
votes
1answer
238 views

Attack of an RSA signature scheme using PKCS#1 v1.5 encryption padding

My best interpretation of this question is that Java's crypto API has been subverted to perform RSA signature using PKCS#1 v1.5 encryption padding. Assume the signature $S$ of a message $M$ is ...
1
vote
1answer
136 views

Why should a signature use PSS padding in RSA?

Suppose I send a message using AES (private keys already negotiated securely) and I send a hash of this message using RSA (encrypted with private key) with OAEP to verify the authenticity and ...