Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].

learn more… | top users | synonyms

1
vote
1answer
155 views

Certificate signature with SHA-1 and RSA: where do 1888 bits come from?

Plenty of X.509 Certificates use "PKCS#1 SHA1 with RSA encryption" as the Certificate Signature Algorithm for generating a 2048-bit signature. The SHA-1 hash function generates a hash value of 160 ...
2
votes
3answers
194 views

How can we sign a contract digitally between two parties?

I'm trying to sign a contract with another party, without using handwritten signatures. I've just read through Applied Cryptography, but there doesn't seem to be a protocol that can solve this ...
3
votes
2answers
316 views

Signature based on public key cryptography and forgery

In the definition of existential unforgeability, there is no detail about the following questions. In general, can we suppose that a signer is also a possible adversary ? When generating a signature, ...
0
votes
2answers
97 views

Needed: signature over a collection of hashes

I'm looking for some kind of crypto-based data structure that will allow me to produce a signature over a set of hashes. Call this a SignedSetOfHashes. I want to be ...
3
votes
2answers
95 views

One-time digital signatures

Are there digital signatures for which, given two documents signed by the same key, one could derive the key? With such one-time signatures, one may be able to design a cryptocurrency based on ...
3
votes
1answer
75 views

Signing the hash of a key with the same key

Given a private signature key sk and a public signature key SK, does revealing sk(H(SK)) (in ...
0
votes
0answers
110 views

Going Blind, Group or Ring?

I have several problems approaching the following problem: Let's assume that we have Alice, Bob and Cathy. Alice wants to present a message to Cathy, showing her that someone else has signed it (Bob), ...
1
vote
1answer
104 views

Is it ok to send part of digital signature if we have bandwidth constraints?

When creating digital signatures is it ok to send part of it when we have bandwidth constraints?
1
vote
2answers
172 views

Shamir's ID based signatures

I am currently implementing Shamir's ID based signature algorithm as proposed in Adi Shamir, Identity-Based Cryptosystems and Signature Schemes. Advances in Cryptology: Proceedings of CRYPTO 84, ...
1
vote
0answers
55 views

How to specify last $t$ bits are only sent when a signature is sent?

I have read that in cases where there is a limit on the amount of data sent over the network, one idea is to sent only $t$ bits of data rather than sending all the bits. For example, in the Schnorr ...
0
votes
1answer
86 views

ElGamal encryption with private key [closed]

Does the encryption with a private key and decryption with a public key works in ElGamal likewise what is done when we use RSA for sender authentication?
0
votes
1answer
144 views

What does $\Pi$ represents in cryptography?

I am doing a project in cryptography and while reading a tag generation algorithm for files, I got stuck with the meaning of $\Pi$. The screenshot of the algorithm is inserted below. Here KeyGen ...
2
votes
1answer
115 views

Does changing the random number selected for each message increase security in Schnorr's scheme?

I was reading about Schnorr's scheme and in that for signing the signer generates a random number and continues with his operation. I am trying to implement this in a scenario where the signature ...
1
vote
0answers
77 views

Factorization or discrete logarithm is difficult for an attacker?

I have read that difficulty in breaking many algorithms are based either on Factorization or discrete logarithm. I am reading about schemes that are similar to RSA which make use of integer ...
3
votes
1answer
99 views

How to protect against ephemeral key reuse in some signature schemes?

Given that some signature schemes (for instance Elgamal) use an ephemeral key that cannot be reused ever. How do people usually protect against this? I'll elaborate more: if you reuse the ephemeral ...
1
vote
1answer
540 views

What is the difference between SHA256WITHRSA and SHA256WITHRSAENCRYPTION digest algorithms?

I installed djigzo on my android phone and I want to use it for smime mail. I don't know the difference between choosing SHA256WITHRSA and ...
1
vote
0answers
72 views

Is allowing a user to specify a Curve25519 signing key secure?

The cryptocurrency Nextcoin has users create Curve25519 signing keys with a minimum length of 70 characters. Is that secure? Would it be better to use a random number generator? Is it possible to ...
1
vote
0answers
68 views

Is this the proper way to generate an Ed25519 signing key? If not, how?

In the test of this Java implementation of Ed25519, the signing key is generated this way: byte[] sk = new byte[32]; Arrays.fill(sk, (byte)0); Is that correct? ...
6
votes
2answers
987 views

Why hash the message before signing it? Digital signature with RSA

Here's a method to sign the message with RSA: Why hash the data before signing it? Why not sign the whole message? It'll save time if you sign the hash value, but I've heard there are also security ...
1
vote
1answer
454 views

Is Curve25519-java secure?

I have only about 2 weeks of cryptography experience mostly in the form of questions on bitcoin.se. Is Curve25519-java up to date with current Curve25519 standards? Is Curve25519 itself secure? ...
4
votes
2answers
480 views

A timestamping authority (digital notary)

Does there currently exist a free online service that accepts a file, hashes it, takes an authoritatively chosen timestamp (from one or more time services), signs these and sends this signed message ...
4
votes
1answer
321 views

RSA Encryption and Signature - Weak Padding

Assume that I have an plaintext $m$ and it is padded with $randompad||00||m$ and then it is encrypted with RSA and a public encryption key so we get the encrypted $Sm$. Then to assure its integrity ...
4
votes
1answer
151 views

Unforgeability and type of adversary

When trying to prove security of asymmetric signature, for instance for existential (or strong) unforgeability against chosen messages attack, do we need to consider the signer as a possible ...
1
vote
1answer
108 views

Difference between implicit signature and explicit signature

In most of time, what I see is explicit signatures such as ElGamal, it's rare to see the implicit signatures. So I wonder why it's rare to be seen? what aspect is it mainly used? what's the ...
1
vote
1answer
70 views

Sample RSA-style signature confusion

I'm trying to study a simplified TLS-style protocol, including verifying RSA signatures. It's an attempt to verify using only a valid certificate. However, I can't manage to get anything to verify ...
4
votes
3answers
179 views

Why can an RSA signature be authenticated ONLY with the signer's public key?

I'm an undergraduate Math student currently taking a cryptology course. I have a question about the RSA signature authentication mechanism. An RSA signature can be authenticated with the public key ...
6
votes
2answers
536 views

Using the same RSA keypair to sign and encrypt

The RSA signature operation is basically the same as encrypting with the private key. In particular, both operations use the same kind of keys. Is it safe to use the same RSA keypair both for ...
4
votes
3answers
161 views

Why use a timestamp and how can someone know it's the correct one?

Let's say A wants to send a message, so everyone who gets the message, can be assured that it's from A. A then sends a message ...
0
votes
0answers
28 views

Finding ECDSA public key from signature samples [duplicate]

How many plain ECDSA signature samples are needed to guess the corresponding public key from it like RSA? Otherwise, is it impossible to guess public key from ECDSA signature/encryption messages?
3
votes
1answer
82 views

What is the impact of the Goppa code distinguisher on the CFS and McEliece?

What is the impact of the distinguisher for the high-rate Goppa codes (as published in "A Distinguisher for High Rate McEliece Cryptosystems") on the CFS signature scheme and the McEliece/Niederreiter ...
1
vote
1answer
142 views

What is a Trapdoor in Merkle Signature?

Merkle signature (pag. 40) use than public key (verification key) the root of the Merkle Tree and than private key (to sign) the set of pre-images of the $g(Y_i)$ where $Y_i$ is the verification key ...
1
vote
0answers
82 views

Generating a valid signature on El-Gamal without knowing the private key

Suppose we are given $p$, the large prime, $g$ which is the primitive root for $p$, $b$ which is calculated as $b=g^x$ mod $p$ where $x$ is the private key and $0<x<p-1$. Also suppose we know ...
1
vote
1answer
107 views

Merkle Tree High Tree

I'm reading Merkle tree signatures and I like know if the security of the that scheme depends, also, of the high of the tree or only depends that hash function is resistant to collision?
1
vote
1answer
214 views

Can you explain partial private key extract algorithm in certificateless Public key cryptography?

Related to the algorithms of certificate-less Signature approach of Al-Riyami and Paterson… Why is there a need for a "partial private key extract algorithm"? Why should it be needed when ...
1
vote
1answer
164 views

How do I sign data that's been encrypted using public key? (RSA)

I've received a public key to encrypt my data for the other end to decrypt using their private key. Now, they want us to sign the data as well to ensure non-repudiation. I thought that I should only ...
2
votes
1answer
63 views

How to pass an arbitrary signature to a certificate

I am trying to sign certificate (X509) using secret sharing. That is shareholders combine their signatures to produce the final signature which will be in this case the signed certificate. However ...
2
votes
1answer
248 views

RSA 896 vs 1024 vs 2048 in Javascript?

I am currently working on a secure messaging website and I had been using RSA 2048 for encryption, decryption and signing of messages but I found it to be EXTREMELY LAGGY so i've moved to 1024. I did ...
2
votes
1answer
304 views

How is digital signature different from a message authentication code (MAC)?

I know the definitions of both but can't specifically tell how they are different and if one is better than the other. Please help.
1
vote
1answer
144 views

Is there proof to the relation between the gap Diffie-Hellman problem and the the Cha-Cheon signature scheme?

I am trying to prove that: "If the gap Diffie-Hellman problem is easy, then the Cha-Cheon signature scheme will be broken." Can you help me to prove it? Is there any proof to the relation between ...
1
vote
1answer
95 views

Verifying a Signature

Alice publishes $(n,e)$ where $n$ is exponential modulus and $e$ is the public key. We have $n=80$ digit number and $e=3$. Bob, in correspondence with Alice, asked Alice to prove she is really Alice, ...
0
votes
1answer
231 views

Simple digital signature example with number

I've been looking for a simple which signs a number with some randomly generated key and then verified(decrypts the original number) with the public key, which is generated by the private. All the ...
1
vote
1answer
301 views

What does an RSA signature look like?

I am using OpenSSL libs to generate signatures. Internally, I learn that a signature is a hash of the message with some padding added to it. I am trying to understand the structure of a signature. If ...
1
vote
1answer
159 views

Security Consideration on The Use of Random Number in Digital Signature

key-exchange protocol allows two parties to establish a shared key over public network. Lacking of authentication the original Diffie–Hellman key exchange is insecure under man-in- -the-middle ...
1
vote
2answers
1k views

Is javascript RSA signing safe?

I'm currently working on a secure open source messaging system (https://github.com/DSMNET/DSMNET). Currently I'm using the cryptico.js (https://github.com/wwwtyro/cryptico) library to encrypt all the ...
1
vote
0answers
69 views

LogSpace Merkle Traversal

I am studying LogSpace Merkle Tree Traversal algorithm in "Post Quantum Cryptography". I don't understand the Table 1 on page 58. My question is: Why within of the $2^h$ rounds for $NEED_h$ exist ...
4
votes
1answer
265 views

What signature schemes allow recovering the public key from a signature?

It seems to be possible to retrieve the (public) key used for creating an ECDSA signature just from the signature alone. This seems like an interesting property; as far as I know, RSA doesn't share ...
3
votes
0answers
185 views

Reasons for SM2 Digital Signature Algorithm

In the IETF RFC draft named "SM2 Digital Signature Algorithm" a signature algorithm is specified. The RFC does however not mention why this signature algorithm has been defined. Nor does it specify ...
5
votes
1answer
4k views

How does RSA signature verification work?

I understand how the RSA algorithm works for encryption and decryption purposes but I don't get how signing is done. Here's what I (think) I know and is common practice: If I have a message that I ...
1
vote
2answers
172 views

What security flaw exists in MAC authentication scenario?

What security flaw exists (if any) in the solution of this non-encrypted authentication scenario? An unencrypted message passes one-way from computer A to B. Its transmission is viewable by the ...
4
votes
2answers
187 views

Fractal Merkle Traversal

I am studying Fractal Merkle Tree Traversal algorithm in this book. In the [pag. 54] I don't understand this paragraph: We may determine the number of pebbles returned at these times by ...