Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].

learn more… | top users | synonyms

4
votes
1answer
98 views

How does a company like Apple keep its keys safe? [closed]

Whatever key is used to sign new iOS updates (for example) must be incredibly well-protected. How does a huge corporation like Apple keep those 4096 bits safe?! Same goes for SSL keys for websites ...
3
votes
1answer
92 views

What is the intuition for ECDSA?

I understand DH and ElGamal and RSA encryption/signatures. But when I look at ECDSA (or plain DSA), it seems like the formulas are just pulled out of thin air. I can verify that the algebra used in ...
1
vote
1answer
86 views

Better security than SHA1 for signature?

An application that I maintain uses Sparkle Update to update itself. I expect attacks from high level attackers (China, USA's NSA, etc.) and have some questions about how secure the cryptography ...
1
vote
2answers
55 views

Merkle signature scheme

I was browsing the Wikipedia article on Merkle signature schemes and noted that it says: The number of possible messages must be a power of two[…] Why is that? ...
0
votes
0answers
16 views

Why Sflash signature scheme is constructed in this way?

Sflash is a Multivariate signature scheme that was accepted by NESSIE in 2003, and completely broken in 2007 by a differential attack. Despite I know the total break of Sflash signature scheme and the ...
4
votes
0answers
54 views

How does Boneh–Lynn–Shacham work?

As described by Wikipedia, BLS uses Diffie-Hellman in some way. I understand how Diffie-Hellman works in both its normal and elliptic curve forms. But what is the "pairing function"?
6
votes
2answers
195 views

What is the threat to a PKI when the root CA certificate is generated using SHA1?

We have thousands of servers that have been issued certificates signed by our CA using SHA256 but the our root CAs own certificate was generated using SHA1. Assuming SHA1 is no longer secure for our ...
2
votes
1answer
102 views

Shouldn't a signature using ECDSA be exactly 96 bytes, not 102 or 103?

Attempting to use openssl to create a signature is confusing on several levels: If I'm using it to sign a hash that I've already created (HMAC-SHA-384-192, specifically), a. why must I specify ...
1
vote
1answer
49 views

Universal reencryption for signatures

Universal reencryption is an interesting encryption primitive. Attempts to build signatures schemes or protocols with authentication incorporating it have frequently failed though. A plausible ...
4
votes
1answer
67 views

How does the verification process associated with this signature scheme work?

My cryptology professor asked us to show that while the following signature scheme is conceptually valid, that it is inherently insecure, however, I am not sure how to demonstrate that the associated ...
3
votes
2answers
370 views

Is authenticated encryption unnecessary if the message is digitally signed?

Normally, it is necessary to use authenticated encryption if the message may be tampered with. Can the authentecation be omitted if the message has been otherwise authenticated?
0
votes
1answer
52 views

Breaking the Rabin Signature system with chosen message attack

I heard that we can break the Rabin Signature system using chosen-message attack. I can't find a message to ask for its signature in order to spoof my message M. Any suggestions?
0
votes
1answer
28 views

Vulnerabilities in specifying the hash algorithm used for signature verification on a per-message basis

Let's say that I have a 4096-bit RSA key and when I sign data, I typically use SHA-512. As far as I understand it, the hash algorithm used to sign/verify a message is specified in the message. If a ...
2
votes
1answer
65 views

Proving property of Modified Rabin Signature

I'm trying to prove one of the properties of the “Modified Rabin Signature Scheme”: If $gcd(x, n) = 1$, then $x^{\frac{(p−1)(q−1)}{2}} \equiv 1 \pmod n$ This is what I’ve got so far… Proof Let ...
2
votes
1answer
129 views

Using e-ID Number for Encryption and Digital Signing

I want to use e-ID number for performing Encryption/Decryption and Digital Signing - and in order to do so, I've opted a PGP-oriented approach which goes a bit like this. Generating PGP key-pair ...
6
votes
3answers
702 views

What is the advantage of digital signatures over message authentication codes?

Studying for CISSP these choices seemed limited: What is the advantage of digital signatures over message authentication codes? Digital Signature provides integrity verification while ...
2
votes
1answer
51 views

Winternitz Signature in standard model

I am studying the Winternitz signature and I describe its algorithms in the next W-OTS Key Generation. Select the parameter $w\geq 2$ that is the bit size of the partitions of the message to be ...
4
votes
2answers
87 views

Importance of random number generation in Schnorr's signature

In Schnorr's digital signature protocol (https://en.wikipedia.org/wiki/Schnorr_signature), the signing process (as described in wikipedia) requires the generation of a random bit $r$. I am wondering ...
8
votes
1answer
126 views

Could this “symmetric RSA” scheme provide key compromise resistant communications?

This question, and fkraiem's answer to it, made me wonder about the security and practicality of using "symmetric RSA" to provide a partially compromise-resistant secure channel. Specifically, assume ...
1
vote
1answer
79 views

setting the MGF hash to a different value other than the regular hash with openssl for PSS signatures

In PKCS1's Probabilistic Signature Mode you have the Hash and the MGF Hash. Both appear to be, by default, sha1, with the OpenSSL CLI client, however, I can change it to sha256 with the following: <...
1
vote
1answer
57 views

Can the original message be retrieved from a public/private key signature?

When I sign a message (which has potentialy low entropy) using a private key and I send it without the original message, can the original message be retrieved from the signature(s)? I want to prove – ...
4
votes
1answer
77 views

Compromise between HMAC and Digital Signature, by encrypting and sending secret key?

For achieving stateless authentication tokens (like JWT), is there a compromise between the performance of HMAC, and public key distribution of Digital Signature? Scenario: Sender is a centralized ...
5
votes
1answer
79 views

Choice of the one-way function (OWF) for Lamport signatures

I am studying the Lamport signature scheme, and I found that in many sources (eg: Hash-based Digital Signature Schemes) the input and output bitstring of the OWF and the message digest have the same ...
5
votes
0answers
123 views

Efficient way to confirm identity

I am working on a multiplayer game. I have a central server which handles all data transmission and coordinates all games. Clients which involved in a single session send requests to do actions to ...
9
votes
2answers
292 views

Why use Diffie-Hellman key exchange over RSA (or any public-key encryption)?

In Diffie-Hellman key agreement between Alice and Bob, Alice computes and sends $g^a$ to Bob, and Bob computes and sends $g^b$ to Alice. Alice then computes $(g^b)^a$, and Bob computes $(g^a)^b$; $g^{...
2
votes
1answer
131 views

textbook RSA signature scheme security

Are textbook RSA signatures secure if an Adversary does not have access to ask signing oracle queries?
2
votes
2answers
83 views

comparison of security for identity based signature and Hashing (SHA-1) the identities

I would like to know which method can provide better security: using identity based signature or hashing the identities and message (using SHA-1) for authentication?
0
votes
0answers
35 views

NTRUSign Hashing

I have some trouble understanding the inner workings of NTRUSign. So what I have understood so far is, that when Alice wants to sign a message she does the following steps Convert Alice's message ...
0
votes
1answer
39 views

can session key be be used as digital signature?

if two communicating parties share a (symmetric) session key, k. When one of the party wants to send a message 'm' to other, is it okay use {m}k as a digital signature?
0
votes
1answer
70 views

Fast Forward Hash Signatures

As a follow up to the Q/A session: Small Quantum Signatures - Reality check needed I have implemented the discussed idea for a new short-quantum-safe signature system using fast-forwarding hash. It ...
0
votes
1answer
85 views

Doubts about Authenticated Data Structures logic

I am studying the theory of authenticated data structure, like Merkle Tree and I have a doubt: why use them? I explain better: why to be sure, for example, that a cloud provider didn't modify my files ...
1
vote
1answer
66 views

How are all necessary parameters shared between signer and verifier in ED25519 signature scheme?

I want to use ED25519 signature scheme in my application which requires frequent sharing of secret data between two entities in public domain. I know that Schnorr signature scheme has a key ...
3
votes
1answer
173 views

Checking the integrity of RSA public key

Let's say I need to verify a digital signature and the public key is stored in untrusted storage which I need to fetch before I verify the digital signature. However, I can store the cryptographic ...
1
vote
1answer
82 views

Which hash function is usually used in RSA?

I know there are several available, however I can't seem to find whether there is one standard one or not. I think I understand the process of digital signatures, just wondering which has function is ...
4
votes
0answers
68 views

How to use a stream cipher to sign a message?

Are there known constructions which allow to sign a message M (let's say it will be sent as clear text) using a stream cipher C and a symmetric secret key K? So, we have M, C, K and we want to send M|...
1
vote
0answers
60 views

How to check the signature without the predetermined function in ECDSA from openssl?

I'm developing a client for a two-factor authentication in Qt/C++ under openSUSE 13.2, 64bit. I've got the FIDO U2F Security Key from yubico/fido. I'm using the classes from openssl, in particular <...
1
vote
1answer
346 views

Signing/verification between Java and the OpenSSL

I'm trying to sign/verify data between a C application and a Java application. In java for now I was using the built-in JCE provider with SHA256withRSA as ...
0
votes
0answers
19 views

Encrypted vs unencrypted digital signatures [duplicate]

Is there a difference in terms of security between An encrypted stream of bits obtained by encrypting a plaintext concatenated with it's signature $ C = E_k(plaintext||\sigma)$ where $E$ is a ...
0
votes
0answers
55 views

How to sign an elliptic curve point using an ECC signature scheme?

In Schnorr based ECC signature scheme, a message $M$ is signed with the private key $\mathit{sk}$ as $$s=\mathit{sk}\cdot h(M,R)+k$$ where $R=k\cdot P$ and $P$ is a base point. If $M$ is a point $(x,y)...
1
vote
0answers
17 views

Remotely Verify File Timestamp

I'm working for a professor to build a platform for students to take midterms and finals online. The student downloads the test during class (when the professor makes the test available on the server ...
2
votes
0answers
66 views

EdDSA Verification vs. Cofactorless Verification

In the EdDSA for more curve paper the authors defines: Keys An EdDSA secret key is a $b$-bit string $k$. The hash $H(k) = (h_0, h_1, ... , h_{2b−1})$ determines an integer $s = 2^n+\sum_{c≤i<n}...
2
votes
1answer
43 views

Is there a single-use signature scheme, where a second use of the private key discloses it to the world?

With ECDSA (and possibly DSA too) I'm aware that if the same value for $k$ is used with the same private key $D_A$ to sign two different messages, then anyone possessing the two messages $m_0$ and $...
3
votes
1answer
53 views

Is there a standard notation for a message concatenated with its signature?

I'm wondering what's the standard (or canonical) notation for "a message along with its signature", i.e. $$ \mathit{Message}~\Vert~\sigma_k(\mathit{Message}) \text. $$ Here the duplicated $\mathit{...
3
votes
3answers
696 views

Is it usual for a signed message to contain the public key of the signer?

In protocols/systems which use ECDSA, is it common for the message to contain the public key of the message signer? If not, how do recipients know that the message has been signed by the correct ...
3
votes
1answer
90 views

What is the correct name for bytes which are to be signed?

I have some bytes, and I sign them with my private key using ECDSA. The resultant (71) bytes are the signature. But what is the name of the bytes I have signed? (If this were encryption, they would ...
1
vote
2answers
118 views

Is signing a plaintext sufficient?

If I have N bytes of plaintext, does signing it with my private key prove (to holders of my public key) that I have signed that exact plaintext messages? i.e. could an attacker use the plaintext and ...
5
votes
0answers
41 views

Is it possible and safe to use SAKKE for signing/verification, rather than for encryption?

Is it safe to use the Sakai–Kasahara key encryption algorithm (SAKKE) for signing/verification, rather than for encryption? (Example at bitbucket.org) In particular, I want many Bobs to be able to ...
2
votes
2answers
124 views

How do you communicate the hash function used with RSA signing?

When it comes to RSA signing, I understand why you need to hash the data before signing it, but don't you need to communicate what hash algorithm you use to whoever will need to verify the signature? ...
5
votes
0answers
49 views

Can a one-way accumulator be used in place of a digital signature?

Could a one-way accumulator be used in a manner to replace a digital signature? Can it provide a way to: verify that the data has not been tampered with, and verify that the message is in fact sent/...
2
votes
0answers
46 views

Signing integers and UUIDs and restoring them from a third party server without tampering

I'm educating myself about cryptography. I know this is a long one, but please, bear with me. :) Now I have a scenario in my mind and I'd like to ask if what I've thought is sound (enough), what more ...