Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].

learn more… | top users | synonyms

6
votes
1answer
189 views

Including a “purpose” designation in a digital signature

A signature of some data can mean many different things, such as: This is a message I sent, this is a certificate I validated,... So I was surprised that common signing schemes don't include a "...
6
votes
3answers
4k views

Why can't Diffie-Hellman be used for signing?

I understand that signing is often a case of hashing data and then encrypting the hash with the private key. What properties keep Diffie-Hellman from being useful for this?
6
votes
1answer
1k views

Description of signatures with message recovery (as in ISO/IEC 9796-2 and EMV Signatures)

I'd like to get an overview of how the signatures with message recovery work, especially in case EMV and other smart card systems. Is there a nice overview available without being required to read the ...
6
votes
1answer
84 views

Do asymmetric signatures require constant-time verification?

To avoid a timing attack, HMAC signatures are usually compared in constant-time (every byte is compared, and the results aggregated). Is the same necessary for asymmetric signature algorithms such ...
6
votes
2answers
133 views

Is there a way to compress multiple signatures of the same data?

So, I'm working with a system that allows individual users to each have their own private-public key pair. I would like to allow multiple users to use their private key to sign the same piece of ...
6
votes
1answer
278 views

Proving the possession of signature in zero-knowledge

Does anybody know an efficient mechanism to prove the possession of a digital signature (e.g. RSA) on a certain attribute (message) in zero-knowledge? That is, without revealing the actual signature (...
6
votes
3answers
509 views

One-time digital signatures

Are there digital signatures for which, given two documents signed by the same key, one could derive the key? With such one-time signatures, one may be able to design a cryptocurrency based on proof-...
6
votes
1answer
766 views

What signature schemes allow recovering the public key from a signature?

It seems to be possible to retrieve the (public) key used for creating an ECDSA signature just from the signature alone. This seems like an interesting property; as far as I know, RSA doesn't share ...
6
votes
1answer
4k views

RSA-PSS salt size

One of the inputs of RSA-PSS signing and verification is the salt size. According to PKCS#1, you must know the salt size before the verfication is carried out. However, this makes interoperability ...
6
votes
2answers
187 views

What is the threat to a PKI when the root CA certificate is generated using SHA1?

We have thousands of servers that have been issued certificates signed by our CA using SHA256 but the our root CAs own certificate was generated using SHA1. Assuming SHA1 is no longer secure for our ...
6
votes
4answers
202 views

Authenticating data generated by a particular build of an open source program

[I was torn between posting here or security.stackexchange.com. In the end, I felt that this was more of a design question, rather than an implementation question and so chose this forum.] My ...
6
votes
1answer
145 views

Cryptography used for login and signing transactions

My bank uses a smartcard reader (separate module not connected to the computer) as depicted below: When I need to log into my account it provides me with a challenge and I need to provide some ...
6
votes
1answer
557 views

Threshold Signatures for RSA and DSA

I have a few questions relating to threshold signatures: a scheme where $n$ participants hold a key share and any $t$ of them can conduct a protocol using their shares that results in a valid RSA or ...
6
votes
0answers
57 views

Explanation and proof of a well-know probabilistic lemma

Pointcheval and Stern in their paper on "Security proofs for Signature Schemes" state the following "well-known" probabilistic lemma: Let $A \subset X \times Y$, such that $\mathrm{Pr}[A(x, y)] \...
5
votes
3answers
903 views

How can one sign with NTRU?

I am looking at implementing NTRU, but I noticed that while the encryption/decryption algorithm seems to be mature and well-documented, there is comparatively little information about how to sign ...
5
votes
2answers
831 views

Is RSA encryption of a cryptographic hash with a private key the same as signature generation?

It is often said that RSA encryption with a private key is the same as signing (signature generation). Will RSA encryption with a private key over a cryptographic hash give the same result as ...
5
votes
4answers
2k views

Is it possible to pick your Ed25519 public key?

Is it possible to generate an Ed25519 keypair that has a very similar public key as another keypair (fooling a casual visual comparison) or is this as hard as solving one of SHA-512 or the discrete ...
5
votes
1answer
212 views

Should different key pairs be used for signing and encryption?

In the recent iOS Security white paper from Apple (February 2014), the section on iMessage discusses using two different asymmetric key types as part of its standard operation: When a user turns ...
5
votes
2answers
898 views

Is a RSA-signature of some identifying data a safe way to implement a license key?

I have this idea of implementing a license key: After the user downloads the program, he connects to a website and sends his Windows product ID. The website, then, sends this back to him with a ...
5
votes
2answers
21k views

FIPS 140-2 Compliant Algorithms

Is there any reference to check the list of encryption & signing algorithms which are compliant to FIPS 140-2. After an exhaustive search I could find only "AES". Any suggestions would be much ...
5
votes
2answers
114 views

Signing MD5 hashes with RSA? [duplicate]

Lets say I need to update a project and allow anyone to distribute the updates, however I need it to be secure, so I hash the data and sign the hash, this project uses MD5. How likely would it be ...
5
votes
2answers
515 views

Are there any digital signature algorithms in common use that result in 32-byte signatures?

I don't consider myself to be an expert in this field, so forgive me if there is an obvious answer. I am having a tough time finding an algorithm that can sign data and output a 32-byte signature, ...
5
votes
4answers
6k views

Diffie-Hellman and man-in-the-middle attacks

See here for the man-in-the-middle attack on Diffie-Hellman that I'm concerned about: What is Diffie-Hellman? How do we combat this? I have two questions: Is one solution for both Alice and Bob ...
5
votes
1answer
317 views

Why doesn't this replay attack work on ECDSA?

I've just started working with elliptic curves and ECSDA in particular, so my understanding of the underlying math isn't great. The thing I'm currently stuck on is trying to understand why replay ...
5
votes
1answer
69 views

Can RSA-PSS signing be made deterministic without loss of security?

Is it possible to make RSA-PSS signing deterministic without loss of security? Specifically, I would use Blake2b of the key and message to generate the salt.
5
votes
2answers
690 views

Why use randomness in digital signature algorithms?

I understand why randomness has to be employed in encryption, because deterministic ciphers are not IND-CPA. I don't understand why digital signature schemes that employ randomness, like RSA-PSS, are ...
5
votes
2answers
285 views

Given a message and signature, find a public key that makes the signature valid (ECDSA)

This question is a variant on Given a message and signature, find a public key that makes the signature valid, which discusses the analogous question for RSA. It was suggested to me by this post over ...
5
votes
1answer
930 views

what are the advatanges and disavantages of the digital signature algorithms for JWT?

I am using a Java JWT library jose4j. There is a list of digital signatures algorithms which can be used. HMAC using SHA-2 RSASSA-PKCS1-V1_5 Digital Signatures with with SHA-2 Elliptic Curve Digital ...
5
votes
1answer
312 views

Unforgeability and type of adversary

When trying to prove security of asymmetric signature, for instance for existential (or strong) unforgeability against chosen messages attack, do we need to consider the signer as a possible adversary?...
5
votes
2answers
940 views

ElGamal signature without calculating the inverse

I stumbled upon this question in some textbook. Propose a variant of ElGamal signature scheme such that there is no need to calculate the inverse $k^{-1}$ as it is usually done using the EEA. ...
5
votes
2answers
140 views

More efficient and just as secure to sign message hash using Ed25519?

According to the Ed25519 paper, the (potentially long) input message is hashed twice (see Section 4 page 12 steps 1 and 3). This webpage has a nice diagram toward the bottom that illustrates this, ...
5
votes
2answers
1k views

How is digital signature different from a message authentication code (MAC)?

I know the definitions of both but can't specifically tell how they are different and if one is better than the other. Please help.
5
votes
1answer
283 views

Safely use CryptSignAndEncryptMessage?

I am developing an application that sends messages which I want to encrypt and sign. The CryptoApi offers a function called CryptSignAndEncryptMessage. The description says, what this function ...
5
votes
1answer
253 views

One-way hash on encrypted data, result hidden from hasher

I'm looking for a one-way hash function that can be performed by A on an encrypted piece of data E(D) provided by B, without the performer A able to figure out D or H(D). This similar to HMAC(Message, ...
5
votes
1answer
79 views

Choice of the one-way function (OWF) for Lamport signatures

I am studying the Lamport signature scheme, and I found that in many sources (eg: Hash-based Digital Signature Schemes) the input and output bitstring of the OWF and the message digest have the same ...
5
votes
1answer
268 views

Is it possible to weaken a bitcoin private key by “using” it elsewhere?

What are the increased possibilities (if any) of being able to crack a private key given the following: The associated bitcoin (ECDSA Secp256k1-based) public key is known. The private key has been ...
5
votes
1answer
177 views

Digital signature for an expiring password

I would like to create a publicly available tool that is used to generate a password that gives a limited time access to a resource. My idea is to digitally sign the current date with a private key ...
5
votes
0answers
120 views

Efficient way to confirm identity

I am working on a multiplayer game. I have a central server which handles all data transmission and coordinates all games. Clients which involved in a single session send requests to do actions to ...
5
votes
0answers
41 views

Is it possible and safe to use SAKKE for signing/verification, rather than for encryption?

Is it safe to use the Sakai–Kasahara key encryption algorithm (SAKKE) for signing/verification, rather than for encryption? (Example at bitbucket.org) In particular, I want many Bobs to be able to ...
5
votes
0answers
46 views

Can a one-way accumulator be used in place of a digital signature?

Could a one-way accumulator be used in a manner to replace a digital signature? Can it provide a way to: verify that the data has not been tampered with, and verify that the message is in fact sent/...
4
votes
1answer
465 views

How is the message digest related to Signatures and Encryption?

I was studying about 'Data Security' and I found out this one thing confusing. What is an message digest? I got it is the hash of the message. Is the message here referring to the plaintext or ...
4
votes
3answers
1k views

public key cryptography and digital signature

I read the following from Understanding Public Key Cryptography on Microsoft TechNet: Using a private key to establish identity shows that the full encryption and decryption operation was ...
4
votes
4answers
402 views

What is the difference between authenticating and signing a document?

Authenticating a document means to verify it is from the sender. But it seems like signing a document also verifies it’s from the sender. What exactly is the relationship or difference between “...
4
votes
1answer
430 views

Relation between attack and attack model for signatures

I would like to know: What is the relationship between an attack and an attack model. For example, let $\Pi$ be the Lamport signature scheme. This signature has its security based on any one-way ...
4
votes
4answers
1k views

Tamper-proofing log files

Problem Overview I want to securely store log files so the contents are secret, and they can't be modified without detection. The files will be encrypted using authenticated encryption (AES in GCM ...
4
votes
2answers
510 views

X.509 CSR: Why does CA remove signature?

I just read this article on Wikipedia: Certificate Signing Request I'm not a PKI or Crypto expert. As I understand, a CSR (certification request) is always signed by the PKCS#10-Request creator. ...
4
votes
1answer
2k views

Why does Openssh use only SHA1 for signing and verifying of digital signatures?

I am learning SSH protocol. With my current understanding of SSH protocol, I think that message digest algorithms for using in digital signature should be derived from Key Exchange. But Openssh ...
4
votes
3answers
5k views

Is javascript RSA signing safe?

I'm currently working on a secure open source messaging system (https://github.com/DSMNET/DSMNET). I'm currently using the cryptico.js (https://github.com/wwwtyro/cryptico) library to encrypt all the ...
4
votes
1answer
1k views

Why is ElGamal considered non-deterministic?

One difference between RSA and ElGamal is that ElGamal isn't necessarily deterministic (while RSA is). What makes it non-deterministic? Is this advantageous to security? How else does this property ...
4
votes
2answers
84 views

Importance of random number generation in Schnorr's signature

In Schnorr's digital signature protocol (https://en.wikipedia.org/wiki/Schnorr_signature), the signing process (as described in wikipedia) requires the generation of a random bit $r$. I am wondering ...