Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].

learn more… | top users | synonyms

1
vote
1answer
165 views

Security Consideration on The Use of Random Number in Digital Signature

key-exchange protocol allows two parties to establish a shared key over public network. Lacking of authentication the original Diffie–Hellman key exchange is insecure under man-in- -the-middle ...
2
votes
1answer
209 views

Why the need to hash before signing small data?

I’ve got two questions: I’m doing the following: Data : uuid + int + nonce Signature: ECDSA(sha256(Data) ) To verify the signature: ...
5
votes
1answer
208 views

Is it possible to weaken a bitcoin private key by “using” it elsewhere?

What are the increased possibilities (if any) of being able to crack a private key given the following: The associated bitcoin (ECDSA Secp256k1-based) public key is known. The private key has been ...
2
votes
1answer
48 views

ECDSA signature verifiable 1-way transformations

Alice signs a message $m$ with her private key, yielding a signature ($r$,$s$). I want to prove to someone else that I have this signature, but I don't want them to have the knowledge of what ...
-1
votes
1answer
359 views

Verify Signature Failed [closed]

I am writing a small module which will verify signed message. Message will be signed using private key in Smart Card. The inputs are: Signed Message Original Message Public Key / Certificate with ...
6
votes
3answers
777 views

Lamport signature: How many signatures are need to forge a signature?

Lamport signature: Signing the message Note that now Alice's private key is used and should never be used again. The other 256 random numbers that she did not use for the signature she must never ...
3
votes
2answers
357 views

Signature based on public key cryptography and forgery

In the definition of existential unforgeability, there is no detail about the following questions. In general, can we suppose that a signer is also a possible adversary ? When generating a signature, ...
1
vote
0answers
39 views

Distributed authentication in low trust environment

I would like to inquire if there is any Method to achieve the following: There is a list $L$ of $n$ entities that are allowed to perform a certain action. $L$ is cryptographically signed by some ...
3
votes
2answers
118 views

One-time digital signatures

Are there digital signatures for which, given two documents signed by the same key, one could derive the key? With such one-time signatures, one may be able to design a cryptocurrency based on ...
1
vote
1answer
139 views

Non-interactive Zero-knowledge proof signature validation without public key

I'm looking for a method for a scenario with following requirements: At least 3 people (A,B,C,...) are in a Network where they can broadcast messages to everyone but not communicate with a specific ...
4
votes
1answer
112 views

Should different key pairs be used for signing and encryption?

In the recent iOS Security white paper from Apple (February 2014), the section on iMessage discusses using two different asymmetric key types as part of its standard operation: When a user turns ...
1
vote
4answers
141 views

Are there use cases where a signature itself needs to be signed?

I'm writing some code to digitally sign certain files (JSON, if you must know), and I'm trying to understand the use cases, not being a crypto guy myself. I understand there are use cases where ...
1
vote
1answer
120 views

Can I use asymmetric encryption for more powerful write-protection?

I have a game that I am developing which uses a locally-stored internal database. It does not matter to me whether a user can read the file (which, to me, means I don't need a symmetric cipher), but I ...
1
vote
0answers
84 views

Generating a valid signature on El-Gamal without knowing the private key

Suppose we are given $p$, the large prime, $g$ which is the primitive root for $p$, $b$ which is calculated as $b=g^x$ mod $p$ where $x$ is the private key and $0<x<p-1$. Also suppose we know ...
5
votes
2answers
639 views

ElGamal signature without calculating the inverse

I stumbled upon this question in some textbook. Propose a variant of ElGamal signature scheme such that there is no need to calculate the inverse $k^{-1}$ as it is usually done using the EEA. ...
3
votes
1answer
341 views

ElGamal message signatures retrieving the secret value x

If the GCD(r, p-1) is small and the value k is used to sign a message using ElGamal is also small. Then the secret value of x can be determined. Why is this true? How would one retrieve x?
7
votes
1answer
840 views

How can one show that an ElGamal-like signature verification scheme is valid?

For an ElGamal-like signature scheme, I am given two things: The signing function, the verification function. How can I show that the verification function is valid? Example 1: Signing: $s := ...
2
votes
1answer
255 views

Non-standard signature security definition conforming ed25519 malleability

According to the paper “High-speed high-security signatures”… Malleability. We also see no relevance of "malleability" to the standard definition of signature security. Aside from the example, ...
6
votes
3answers
2k views

Why can't Diffie-Hellman be used for signing?

I understand that signing is often a case of hashing data and then encrypting the hash with the private key. What properties keep Diffie-Hellman from being useful for this?
2
votes
1answer
127 views

Is ed25519 a “hash signature”

Writing my last question, I saw the hash-signature tag. I tried to research it best I could, but I'm simply overwhelmed in this field. I don't think it means to simply hash data before signing, but ...
1
vote
2answers
75 views

Shamir's ID based signatures - Notation issues

I am currently implementing Shamir's ID Based signature scheme as defined in the original paper. The sign and verify operation are defined as follows: Sign: $s = g * r^{f(t,m)} (\mod n)$ ...
3
votes
3answers
780 views

Is it possible to pick your Ed25519 public key?

Is it possible to generate an Ed25519 keypair that has a very similar public key as another keypair (fooling a casual visual comparison) or is this as hard as solving one of SHA-512 or the discrete ...
7
votes
3answers
2k views

Why hash or salt when signing?

I've seen an example of how to sign using RSA. Besides the signing itself (s = m^d mod n) it also hashes and adds an IV. Why is that needed?
2
votes
3answers
224 views

How can we sign a contract digitally between two parties?

I'm trying to sign a contract with another party, without using handwritten signatures. I've just read through Applied Cryptography, but there doesn't seem to be a protocol that can solve this ...
1
vote
1answer
317 views

Certificate signature with SHA-1 and RSA: where do 1888 bits come from?

Plenty of X.509 Certificates use "PKCS#1 SHA1 with RSA encryption" as the Certificate Signature Algorithm for generating a 2048-bit signature. The SHA-1 hash function generates a hash value of 160 ...
0
votes
2answers
97 views

Needed: signature over a collection of hashes

I'm looking for some kind of crypto-based data structure that will allow me to produce a signature over a set of hashes. Call this a SignedSetOfHashes. I want to be ...
3
votes
1answer
76 views

Signing the hash of a key with the same key

Given a private signature key sk and a public signature key SK, does revealing sk(H(SK)) (in ...
0
votes
0answers
121 views

Going Blind, Group or Ring?

I have several problems approaching the following problem: Let's assume that we have Alice, Bob and Cathy. Alice wants to present a message to Cathy, showing her that someone else has signed it (Bob), ...
1
vote
1answer
108 views

Is it ok to send part of digital signature if we have bandwidth constraints?

When creating digital signatures is it ok to send part of it when we have bandwidth constraints?
1
vote
2answers
229 views

Shamir's ID based signatures

I am currently implementing Shamir's ID based signature algorithm as proposed in Adi Shamir, Identity-Based Cryptosystems and Signature Schemes. Advances in Cryptology: Proceedings of CRYPTO 84, ...
10
votes
2answers
655 views

Which blind signature schemes exist, and how do they compare?

I'm looking into blind signature schemes for use as digital cash. I have come across blinded RSA, and Lucre(DH based). Are there other schemes available, and how do they compare? I suspect there ...
4
votes
1answer
186 views

Unforgeability and type of adversary

When trying to prove security of asymmetric signature, for instance for existential (or strong) unforgeability against chosen messages attack, do we need to consider the signer as a possible ...
1
vote
0answers
71 views

LogSpace Merkle Traversal

I am studying LogSpace Merkle Tree Traversal algorithm in "Post Quantum Cryptography". I don't understand the Table 1 on page 58. My question is: Why within of the $2^h$ rounds for $NEED_h$ exist ...
1
vote
1answer
152 views

Merkle Signature Generation

In the section 2 (page 42) of the book "Post Quantum Cryptography", it says: Then he generates the one-time signature $\sigma_{\text{OTS}}$ of the digest using the $s$-th one-time signature key ...
1
vote
1answer
100 views

Merkle signature + PRNG?

In the section 3 (page 44) of the book "Post Quantum Cryptography", it says: Then each one-time signature key must be generated twice, once for the MSS public key generation and once during the ...
2
votes
1answer
354 views

Winternitz One-Time Signature

I am reading the page 38 in this "Post Quantum Cryptography" book (Equations 8 and 9). My question is, why to compute the verification key $Y$, $f$ is applied $2^w-1$ times? Are there any security ...
1
vote
0answers
58 views

How to specify last $t$ bits are only sent when a signature is sent?

I have read that in cases where there is a limit on the amount of data sent over the network, one idea is to sent only $t$ bits of data rather than sending all the bits. For example, in the Schnorr ...
0
votes
1answer
94 views

ElGamal encryption with private key [closed]

Does the encryption with a private key and decryption with a public key works in ElGamal likewise what is done when we use RSA for sender authentication?
1
vote
0answers
84 views

Factorization or discrete logarithm is difficult for an attacker?

I have read that difficulty in breaking many algorithms are based either on Factorization or discrete logarithm. I am reading about schemes that are similar to RSA which make use of integer ...
3
votes
1answer
119 views

How to protect against ephemeral key reuse in some signature schemes?

Given that some signature schemes (for instance Elgamal) use an ephemeral key that cannot be reused ever. How do people usually protect against this? I'll elaborate more: if you reuse the ephemeral ...
2
votes
1answer
213 views

ElGamal signature: Forging a signature of a specific form

I have a question I can't solve from one of the courses I'm currently taking: Show that given a legitimate ElGamal signature $(S,R)$ on a given message $m$, an attacker can compute a signature ...
1
vote
1answer
1k views

What is the difference between SHA256WITHRSA and SHA256WITHRSAENCRYPTION digest algorithms?

I installed djigzo on my android phone and I want to use it for smime mail. I don't know the difference between choosing SHA256WITHRSA and ...
5
votes
2answers
818 views

A timestamping authority (digital notary)

Does there currently exist a free online service that accepts a file, hashes it, takes an authoritatively chosen timestamp (from one or more time services), signs these and sends this signed message ...
1
vote
1answer
118 views

Difference between implicit signature and explicit signature

In most of time, what I see is explicit signatures such as ElGamal, it's rare to see the implicit signatures. So I wonder why it's rare to be seen? what aspect is it mainly used? what's the ...
3
votes
2answers
260 views

Are hash trees an alternative, quantum-resistant signature scheme which can replace RSA?

Can hash trees provide quantum resistant signatures to replace RSA for signing securely? What is the key size and how many times can we use same key?
1
vote
1answer
173 views

Is there proof to the relation between the gap Diffie-Hellman problem and the the Cha-Cheon signature scheme?

I am trying to prove that: "If the gap Diffie-Hellman problem is easy, then the Cha-Cheon signature scheme will be broken." Can you help me to prove it? Is there any proof to the relation between ...
4
votes
1answer
375 views

RSA Encryption and Signature - Weak Padding

Assume that I have an plaintext $m$ and it is padded with $randompad||00||m$ and then it is encrypted with RSA and a public encryption key so we get the encrypted $Sm$. Then to assure its integrity ...
2
votes
1answer
134 views

In S/MIME, are the same certificates always used to sign and encrypt messages?

My assumption is that S/MIME almost always utilizes certificates as follows: My certificate can be used to allow people to encrypt messages and send them to me. My certificate (the same ...
4
votes
3answers
185 views

Why can an RSA signature be authenticated ONLY with the signer's public key?

I'm an undergraduate Math student currently taking a cryptology course. I have a question about the RSA signature authentication mechanism. An RSA signature can be authenticated with the public key ...
4
votes
3answers
177 views

Why use a timestamp and how can someone know it's the correct one?

Let's say A wants to send a message, so everyone who gets the message, can be assured that it's from A. A then sends a message ...