Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].
9
votes
2answers
931 views
What is wrong with using SHA1 in digital signatures? Why is a robust hash function needed?
For the purposes of signing and verifying signatures, what is the value of the hash function?
Why would it matter if SHA1 is later determined to be easy to break? Since a Public/Private key process ...
8
votes
5answers
265 views
Reduction from signatures to encryption?
Is it possible to construct an (asymmetric) encryption scheme from a signature scheme?
If the signature scheme is deterministic and allows existential forgery (e.g. RSA), then the answer is yes ...
7
votes
1answer
190 views
Alice trusts Bob only when Bob trusts Alice
some story first: Alice and Bob both have public/private key pairs. Now Bob wants Alice to sign his public key id. Alice agrees but only when Bob signs the public key id of her.
Is this something ...
7
votes
2answers
261 views
Which blind signature schemes exist, and how do they compare?
I'm looking into blind signature schemes for use as digital cash. I have come across blinded RSA, and Lucre(DH based). Are there other schemes available, and how do they compare? I suspect there ...
6
votes
3answers
193 views
Is signing a hash instead of the full data considered secure?
I reference object in some of my code in hashes. The signature is itself is another object separate from the one I am signing (for obvious reason). I consider simpler to simply sign the reference to ...
6
votes
2answers
269 views
What is the key strength reduction encrypting only 160 bits of data using RSA1024 for signatures
I am attempting to determine the strength of an incorrectly implemented 1024 bit RSA signature scheme. The weakness in the implementation is that the padding data lacks random numbers. As a result, ...
6
votes
3answers
512 views
Can ECDSA signatures be safely made “deterministic”?
Using the terminology of the ECDSA wikipedia page, ECDSA (and DSA) signatures require a random k value for each signature which ensures that the signature is different each time even if the message ...
6
votes
1answer
1k views
How do other, non-RSA algorithms, compare to the PKCS #1 standard?
Arguably the PKCS suite of standards have a profit-oriented bias as they are promoted by RSA and promote their algorithms over others in the form of RFCs and other means.
I'm considering the ...
6
votes
1answer
108 views
Why does it matter for a signature scheme to be without random oracles?
There is a profusion of articles proposing signature schemes without random oracles (see for yourself). What does that mean, and why does it matter?
5
votes
4answers
478 views
What is the signature scheme with the fastest batch verification protocol for multiple signers?
I'm looking for a scheme where signing may be costly (slow) but batch verification with different signers is the fastest possible.
Modified ECDSA allows batch verification for different signers with ...
5
votes
1answer
113 views
Including a “purpose” designation in a digital signature
A signature of some data can mean many different things, such as: This is a message I sent, this is a certificate I validated,... So I was surprised that common signing schemes don't include a ...
5
votes
2answers
737 views
What are advantages of using a HMAC over RSA with SHA-1 hashes?
I am currently studying for an exam and this was a previous question:
Give one advantage of using HMACs over using RSA to sign SHA-1 hashes.
My thoughts are that it has something to do with the ...
5
votes
1answer
683 views
RSA-PSS salt size
One of the inputs of RSA-PSS signing and verification is the salt size. According to PKCS#1, you must know the salt size before the verfication is carried out. However, this makes interoperability ...
5
votes
2answers
827 views
Why can't Diffie-Hellman be used for signing?
I understand that signing is often a case of hashing data and then encrypting the hash with the private key. What properties keep Diffie-Hellman from being useful for this?
5
votes
1answer
305 views
Why are MACs in general deterministic, whereas digital signature constructions are randomized?
The fact is I'm not quite sure if my question statement is true, however all the MAC constructions I know of (e.g. CBC-MAC, CMAC, HMAC) are deterministic, whereas many constructions for digital ...
5
votes
1answer
327 views
How can one show that an ElGamal-like signature verification scheme is valid?
For an ElGamal-like signature scheme, I am given two things:
The signing function,
the verification function.
How can I show that the verification function is valid?
Example 1:
Signing: $s := ...
5
votes
1answer
155 views
One-way hash on encrypted data, result hidden from hasher
I'm looking for a one-way hash function that can be performed by A on an encrypted piece of data E(D) provided by B, without the performer A able to figure out D or H(D). This similar to HMAC(Message, ...
5
votes
1answer
123 views
Digital signature for an expiring password
I would like to create a publicly available tool that is used to generate a password that gives a limited time access to a resource.
My idea is to digitally sign the current date with a private key ...
4
votes
2answers
174 views
Signature schemes for underpowered devices (8bit microcontroller)
I am currently researching into a small scale home automation system, aiming for cost. The system architecture is basically one master and several slaves which are connected in parallel.
Recently ...
4
votes
2answers
203 views
X.509 CSR: Why does CA remove signature?
I just read this article on Wikipedia: Certificate Signing Request
I'm not a PKI or Crypto expert. As I understand, a CSR (certification request) is always signed by the PKCS#10-Request creator.
...
4
votes
1answer
440 views
Why is ElGamal considered non-deterministic?
One difference between RSA and ElGamal is that ElGamal isn't necessarily deterministic (while RSA is).
What makes it non-deterministic? Is this advantageous to security? How else does this property ...
4
votes
2answers
413 views
Is a RSA-signature of some identifying data a safe way to implement a license key?
I have this idea of implementing a license key:
After the user downloads the program, he connects to a website and sends his Windows product ID.
The website, then, sends this back to him with a ...
4
votes
1answer
142 views
Is there an algorithm or hardware that can sign/verify natural time?
PGP/GPG can used to sign text, others use public key to verify them.
So one could say, that these cryptographic algorithms deal with space.
Are there any algorithms that can deal with time?
E.g. I ...
4
votes
2answers
361 views
ElGamal signature without calculating the inverse
Last time I asked a question of this type on math.se it was redirected here, so I hope this one is also appropriatete for crypto.se.
I stumbled uppon this question in some textbook.
Propose a ...
4
votes
1answer
199 views
Threshold Signatures for RSA and DSA
I have a few questions relating to threshold signatures: a scheme where $n$ participants hold a key share and any $t$ of them can conduct a protocol using their shares that results in a valid RSA or ...
3
votes
1answer
421 views
What are the differences between a digital signature, a MAC and a hash?
A message may be accompanied with a digital signature, a MAC or a message hash, as a proof of some kind.
Which assurances does each primitive provide to the recipient?
What kind of keys are needed?
3
votes
4answers
907 views
How are timestamps verified?
You put an input and the hash value comes as an output then when someone puts the input the hash function it is applied to see if it is the same hash original value is stored in some database , that ...
3
votes
3answers
425 views
public key cryptography and digital signature
I read the following from Understanding Public Key Cryptography on Microsoft TechNet:
Using a private key to establish identity shows that the full
encryption and decryption operation was ...
3
votes
2answers
1k views
Difference between “Signature Algorithm” and “Signature Hash Algorithm” in X.509
What's the difference between the "Signature Algorithm" and the "Signature Hash Algorithm" found in an X.509 certificate? Why does it need a "Signature Hash Algorithm"?
Edit:
I'm creating the ...
3
votes
1answer
89 views
Why doesn't this replay attack work on ECDSA?
I've just started working with elliptic curves and ECSDA in particular, so my understanding of the underlying math isn't great. The thing I'm currently stuck on is trying to understand why replay ...
3
votes
3answers
467 views
Why hash or salt when signing?
I've seen an example of how to sign using RSA. Besides the signing itself (s = m^d mod n) it also hashes and adds an IV.
Why is that needed?
3
votes
1answer
238 views
What is the computational cost of a public key certificate signature verification?
What is the computational cost of a certificate signature verification in terms of exponentiation, multiplication and other computation operations?
3
votes
3answers
755 views
Should we sign-then-encrypt, or encrypt-then-sign?
We often want to send messages that are both (a) encrypted, so passive attackers can't discover the plaintext of the message, and (b) signed with a private-key digital signature, so active attackers ...
3
votes
2answers
728 views
How do digital certificates work, and why is it not possible to reverse engineer one from a signed file?
Digital certificates are used quite commonly these days, for signing files. They are used by various operating systems to ensure reliability and security. For example, Android requires that each of ...
3
votes
1answer
137 views
Secure encrypt-then-sign with RSA
I understand that when you want to encrypt and sign data with RSA the generally recommended approach is sign-then-encrypt.
However, I have encrypted data that I need to sign, to prove the author of ...
3
votes
1answer
124 views
Safely use CryptSignAndEncryptMessage?
I am developing an application that sends messages which I want to encrypt and sign. The CryptoApi offers a function called CryptSignAndEncryptMessage.
The description says, what this function ...
3
votes
3answers
128 views
Authenticating data generated by a particular build of an open source program
[I was torn between posting here or security.stackexchange.com. In the end, I felt that this was more of a design question, rather than an implementation question and so chose this forum.]
My ...
2
votes
3answers
227 views
How can one sign with NTRU?
I am looking at implementing NTRU, but I noticed that while the encryption/decryption algorithm seems to be mature and well-documented, there is comparatively little information about how to sign ...
2
votes
2answers
421 views
Is RSASSA-PKCS1-v1_5 a good signature scheme for new systems?
Is RSASSA-PKCS1-v1_5 a good signature scheme to recommend that people use in new systems? Is it believed to be secure and represent the state-of-the-art in RSA-based signatures?
I understand that ...
2
votes
2answers
118 views
Is the “Signed on date” of a PGP Signature Verified?
I noticed that PGP signatures have a "signed on" field. I was wondering if this is "trustworthy" information and if so how is it accomplished.
For example, I can't see how it could be trusted ...
2
votes
2answers
238 views
How do public key rings work in cryptographic applications?
I am wondering if there are any links to articles or resources available online, or explanations that you can give, that would help me to understand the concept of a public key ring, and why I might ...
2
votes
3answers
328 views
Is it possible to pick your Ed25519 public key?
Is it possible to generate an Ed25519 keypair that has a very similar public key as another keypair (fooling a casual visual comparison) or is this as hard as solving one of SHA-512 or the discrete ...
2
votes
1answer
124 views
Does it make sense to use slow hashes in digital signatures?
For storing passwords, it seems that the use of intentionally slow hash functions (like PBKDF2 and bcrypt) is now recommended. This is because most hashes are designed to be fast, which also makes ...
2
votes
1answer
427 views
How to sign a message using RSA?
Assuming I already have a D, P, Q, etc of an RSA key: How do I now sign a message? If it matters – the message is around 100 bits.
I don't know much about cryptography, but I can get these numbers ...
2
votes
1answer
103 views
Are digital signatures secure for signing lots of small messages?
I need to sign the numbers from 1 to 1 billion (literally this, it's not an analogy) using a digital signature and then send these numbers in a particular order to someone. The message is not private ...
2
votes
2answers
711 views
Digital Signatures, Standard Hash Functions and MACs
I'm studying Hash functions and Digital Signatures in sequence, and came up with some doubts about their usage.
First of all:
What is the difference between hashing a document and signing it?
And ...
2
votes
4answers
191 views
Tamper-proofing log files
Problem Overview
I want to securely store log files so the contents are secret, and they can't be modified without detection.
The files will be encrypted using authenticated encryption (AES in GCM ...
2
votes
1answer
102 views
Are RSA signatures deterministic?
If I sign the word HELLO with the mechanism "NONEwithRSA" with the same private key, do I always will have the same signature?
A Java example always return ...
2
votes
2answers
255 views
Lamport signature: How many signatures are need to forge a signature?
Lamport signature: Signing the message Note that now Alice's private key is used and should never be used again. The other 256 random numbers that she did not use for the signature she must never ...
2
votes
1answer
360 views
Okay to use OpenSSL to encrypt then sign a message?
I am planning on encrypting a message then signing the message so the recipient can authenticate the source. Reading this article has me concerned that I'm doing something wrong.
My current plan is ...
