Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].

learn more… | top users | synonyms

3
votes
1answer
89 views

What is the intuition for ECDSA?

I understand DH and ElGamal and RSA encryption/signatures. But when I look at ECDSA (or plain DSA), it seems like the formulas are just pulled out of thin air. I can verify that the algebra used in ...
1
vote
1answer
77 views

Better security than SHA1 for signature?

An application that I maintain uses Sparkle Update to update itself. I expect attacks from high level attackers (China, USA's NSA, etc.) and have some questions about how secure the cryptography ...
1
vote
2answers
45 views

Merkle signature scheme

I was browsing the Wikipedia article on Merkle signature schemes and noted that it says: The number of possible messages must be a power of two[…] Why is that? ...
0
votes
0answers
12 views

Why Sflash signature scheme is constructed in this way?

Sflash is a Multivariate signature scheme that was accepted by NESSIE in 2003, and completely broken in 2007 by a differential attack. Despite I know the total break of Sflash signature scheme and the ...
4
votes
0answers
49 views

How does Boneh–Lynn–Shacham work?

As described by Wikipedia, BLS uses Diffie-Hellman in some way. I understand how Diffie-Hellman works in both its normal and elliptic curve forms. But what is the "pairing function"?
4
votes
1answer
194 views

Is it safe to derive a password from a signature provided by ssh-agent?

I'd like to use a password-based system on a remote host (accessed via SSH) without having to copy-and-paste the password and without storing it on disk. Using the system with some other form of ...
5
votes
2answers
125 views

What is the threat to a PKI when the root CA certificate is generated using SHA1?

We have thousands of servers that have been issued certificates signed by our CA using SHA256 but the our root CAs own certificate was generated using SHA1. Assuming SHA1 is no longer secure for our ...
1
vote
1answer
5k views

Simple digital signature example with number

I've been looking for a simple which signs a number with some randomly generated key and then verified(decrypts the original number) with the public key, which is generated by the private. All the ...
1
vote
1answer
46 views

Universal reencryption for signatures

Universal reencryption is an interesting encryption primitive. Attempts to build signatures schemes or protocols with authentication incorporating it have frequently failed though. A plausible ...
1
vote
1answer
63 views

Shouldn't a signature using ECDSA be exactly 96 bytes, not 102 or 103?

Attempting to use openssl to create a signature is confusing on several levels: If I'm using it to sign a hash that I've already created (HMAC-SHA-384-192, specifically), a. why must I specify ...
1
vote
1answer
70 views

Can Winternitz be easily converted to a many-time encryption scheme?

The Winternitz scheme is typically cited as being an OTS scheme. Can it also be used as a one-time encryption scheme? If it can be used as a one-time encryption scheme, then is it possible to easily ...
4
votes
1answer
66 views

How does the verification process associated with this signature scheme work?

My cryptology professor asked us to show that while the following signature scheme is conceptually valid, that it is inherently insecure, however, I am not sure how to demonstrate that the associated ...
1
vote
2answers
123 views

Shamir's ID based signatures - Notation issues

I am currently implementing Shamir's ID Based signature scheme as defined in the original paper (archive link). The sign and verify operation are defined as follows: Sign: $s = g * r^{f(t,m)} (\mod ...
3
votes
2answers
366 views

Is authenticated encryption unnecessary if the message is digitally signed?

Normally, it is necessary to use authenticated encryption if the message may be tampered with. Can the authentecation be omitted if the message has been otherwise authenticated?
2
votes
1answer
269 views

Is it possible to perform a rudimentary asymmetric key encryption algorithm by hand?

I have at least three, distinct motivations for having a simple way to use asymmetric key encryption by hand or without modern computers. First, I was recently demonstrating to a 12-year-old how ...
7
votes
3answers
373 views

ECDSA signature verifiable 1-way transformations

Alice signs a message $m$ with her private key, yielding a signature ($r$,$s$). I want to prove to someone else that I have this signature, but I don't want them to have the knowledge of what ...
4
votes
1answer
420 views

Relation between attack and attack model for signatures

I would like to know: What is the relationship between an attack and an attack model. For example, let $\Pi$ be the Lamport signature scheme. This signature has its security based on any one-way ...
0
votes
1answer
47 views

Breaking the Rabin Signature system with chosen message attack

I heard that we can break the Rabin Signature system using chosen-message attack. I can't find a message to ask for its signature in order to spoof my message M. Any suggestions?
0
votes
1answer
27 views

Vulnerabilities in specifying the hash algorithm used for signature verification on a per-message basis

Let's say that I have a 4096-bit RSA key and when I sign data, I typically use SHA-512. As far as I understand it, the hash algorithm used to sign/verify a message is specified in the message. If a ...
3
votes
1answer
87 views

What is the correct name for bytes which are to be signed?

I have some bytes, and I sign them with my private key using ECDSA. The resultant (71) bytes are the signature. But what is the name of the bytes I have signed? (If this were encryption, they would ...
2
votes
4answers
3k views

Is 512-bit RSA still safe for signature generation?

The standard CSP on Windows XP only supports RSA up to 512-bit, which means that it's the maximum key size I can use for authenticity verification of updates. The public key is embedded in the ...
2
votes
1answer
58 views

Proving property of Modified Rabin Signature

I'm trying to prove one of the properties of the “Modified Rabin Signature Scheme”: If $gcd(x, n) = 1$, then $x^{\frac{(p−1)(q−1)}{2}} \equiv 1 \pmod n$ This is what I’ve got so far… Proof Let ...
0
votes
1answer
75 views

Stern identification scheme to signature scheme

I'm trying to understand the comment in the page 103 of the book Postquantum Cryptography. about convert the identification Stern procedure for signing. Can you write an example of signature of this ...
5
votes
1answer
77 views

Choice of the one-way function (OWF) for Lamport signatures

I am studying the Lamport signature scheme, and I found that in many sources (eg: Hash-based Digital Signature Schemes) the input and output bitstring of the OWF and the message digest have the same ...
6
votes
3answers
602 views

What is the advantage of digital signatures over message authentication codes?

Studying for CISSP these choices seemed limited: What is the advantage of digital signatures over message authentication codes? Digital Signature provides integrity verification while ...
8
votes
1answer
100 views

Could this “symmetric RSA” scheme provide key compromise resistant communications?

This question, and fkraiem's answer to it, made me wonder about the security and practicality of using "symmetric RSA" to provide a partially compromise-resistant secure channel. Specifically, assume ...
0
votes
1answer
72 views

Doubts about Authenticated Data Structures logic

I am studying the theory of authenticated data structure, like Merkle Tree and I have a doubt: why use them? I explain better: why to be sure, for example, that a cloud provider didn't modify my files ...
2
votes
1answer
40 views

Winternitz Signature in standard model

I am studying the Winternitz signature and I describe its algorithms in the next W-OTS Key Generation. Select the parameter $w\geq 2$ that is the bit size of the partitions of the message to be ...
4
votes
2answers
75 views

Importance of random number generation in Schnorr's signature

In Schnorr's digital signature protocol (https://en.wikipedia.org/wiki/Schnorr_signature), the signing process (as described in wikipedia) requires the generation of a random bit $r$. I am wondering ...
1
vote
2answers
111 views

Is signing a plaintext sufficient?

If I have N bytes of plaintext, does signing it with my private key prove (to holders of my public key) that I have signed that exact plaintext messages? i.e. could an attacker use the plaintext and ...
0
votes
0answers
51 views

How to sign an elliptic curve point using an ECC signature scheme?

In Schnorr based ECC signature scheme, a message $M$ is signed with the private key $\mathit{sk}$ as $$s=\mathit{sk}\cdot h(M,R)+k$$ where $R=k\cdot P$ and $P$ is a base point. If $M$ is a point ...
9
votes
2answers
260 views

Why use Diffie-Hellman key exchange over RSA (or any public-key encryption)?

In Diffie-Hellman key agreement between Alice and Bob, Alice computes and sends $g^a$ to Bob, and Bob computes and sends $g^b$ to Alice. Alice then computes $(g^b)^a$, and Bob computes $(g^a)^b$; ...
1
vote
1answer
65 views

setting the MGF hash to a different value other than the regular hash with openssl for PSS signatures

In PKCS1's Probabilistic Signature Mode you have the Hash and the MGF Hash. Both appear to be, by default, sha1, with the OpenSSL CLI client, however, I can change it to sha256 with the following: ...
1
vote
1answer
51 views

Can the original message be retrieved from a public/private key signature?

When I sign a message (which has potentialy low entropy) using a private key and I send it without the original message, can the original message be retrieved from the signature(s)? I want to prove – ...
4
votes
1answer
68 views

Compromise between HMAC and Digital Signature, by encrypting and sending secret key?

For achieving stateless authentication tokens (like JWT), is there a compromise between the performance of HMAC, and public key distribution of Digital Signature? Scenario: Sender is a centralized ...
5
votes
0answers
118 views

Efficient way to confirm identity

I am working on a multiplayer game. I have a central server which handles all data transmission and coordinates all games. Clients which involved in a single session send requests to do actions to ...
2
votes
1answer
115 views

textbook RSA signature scheme security

Are textbook RSA signatures secure if an Adversary does not have access to ask signing oracle queries?
0
votes
0answers
32 views

NTRUSign Hashing

I have some trouble understanding the inner workings of NTRUSign. So what I have understood so far is, that when Alice wants to sign a message she does the following steps Convert Alice's message ...
0
votes
1answer
68 views

Fast Forward Hash Signatures

As a follow up to the Q/A session: Small Quantum Signatures - Reality check needed I have implemented the discussed idea for a new short-quantum-safe signature system using fast-forwarding hash. It ...
0
votes
1answer
39 views

can session key be be used as digital signature?

if two communicating parties share a (symmetric) session key, k. When one of the party wants to send a message 'm' to other, is it okay use {m}k as a digital signature?
3
votes
2answers
827 views

Winternitz One-Time Signature

I am reading the page 38 in this "Post Quantum Cryptography" book (Equations 8 and 9). My question is, why to compute the verification key $Y$, $f$ is applied $2^w-1$ times? Are there any security ...
4
votes
0answers
1k views

Reasons for Chinese SM2 Digital Signature Algorithm

In the IETF RFC draft named "SM2 Digital Signature Algorithm" a signature algorithm is specified. The RFC does however not mention why this signature algorithm has been defined. Nor does it specify ...
2
votes
1answer
157 views

Checking the integrity of RSA public key

Let's say I need to verify a digital signature and the public key is stored in untrusted storage which I need to fetch before I verify the digital signature. However, I can store the cryptographic ...
3
votes
2answers
123 views

(Lightweight) Multicast one-way Authentication

Problem: I'm thinking about a lightweight solution to provide source authentication (only one source) to multiple receivers (multicast message). Context: Taking the problem to ground, we can think ...
1
vote
1answer
77 views

Which hash function is usually used in RSA?

I know there are several available, however I can't seem to find whether there is one standard one or not. I think I understand the process of digital signatures, just wondering which has function is ...
4
votes
0answers
66 views

How to use a stream cipher to sign a message?

Are there known constructions which allow to sign a message M (let's say it will be sent as clear text) using a stream cipher C and a symmetric secret key K? So, we have M, C, K and we want to send ...
1
vote
0answers
50 views

How to check the signature without the predetermined function in ECDSA from openssl?

I'm developing a client for a two-factor authentication in Qt/C++ under openSUSE 13.2, 64bit. I've got the FIDO U2F Security Key from yubico/fido. I'm using the classes from openssl, in particular ...
1
vote
1answer
263 views

Signing/verification between Java and the OpenSSL

I'm trying to sign/verify data between a C application and a Java application. In java for now I was using the built-in JCE provider with SHA256withRSA as ...
5
votes
2answers
20k views

FIPS 140-2 Compliant Algorithms

Is there any reference to check the list of encryption & signing algorithms which are compliant to FIPS 140-2. After an exhaustive search I could find only "AES". Any suggestions would be much ...
0
votes
0answers
18 views

Encrypted vs unencrypted digital signatures [duplicate]

Is there a difference in terms of security between An encrypted stream of bits obtained by encrypting a plaintext concatenated with it's signature $ C = E_k(plaintext||\sigma)$ where $E$ is a ...