Questions tagged [signature]
Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].
1,446
questions
4
votes
2
answers
1k
views
Using ePassport with Active/Chip Authentication to sign documents
I'm a complete newby, so please pardon my ignorance when it comes to basic cryptography aspects.
My question is whether a biometric passport with Active/Chip Authentication (AA or CA) can be used to ...
6
votes
4
answers
1k
views
A practical algorithm for proof of age
I'm new to the list, a layman in cryptography, but a competent programmer. Seeking your help for a practical algorithm that I can implement please.
Problem
Let a prover ...
2
votes
1
answer
170
views
Why isn't the provided scheme UF-CMA secure?
On an exam I recently took, one of the questions was:
Consider the following signature scheme. The public key is $(p,g,g^x)$, where $p$ is a large prime number. $g$ is a generator of $\mathbb Z^*_p$, ...
0
votes
1
answer
75
views
How can I send someone a large file safely without using key exchange protocols (for encryption)?
I recently took an exam where one of the questions was roughly the following:
You need a specific way for sender S to send a large file M to a receiver R with their secret-public key pair, without ...
0
votes
0
answers
77
views
Why using linear increasing nonce in DSA in a bad idea?
Suppose we sign and verify messages with a DSA scheme. Before signing the first
message the necessary parameters $(p,q,h,g,x,y)$ are initialized, including the nonce $k$ as an integer between $(1,q-1)$...
0
votes
1
answer
54
views
Prove a response was received from the particular Tor hidden service
Consider a Tor hidden service. I want to retrieve the main page of such website in such a way that I can later prove to a skeptical third party that the website with this certificate (identified by ...
4
votes
2
answers
1k
views
What is customizable in ECDSA signature and verification?
Let's say I make a signing and verification ECDSA module. The signing module receives a plain message and outputs a signed message. The verification module takes the signed message and checks ...
0
votes
0
answers
29
views
Where is the cryptography library that support group signature?
Finding a cryptography library to implement various application features is not difficult nowadays, thanks to options like NaCl, Google Tink, PyCA, and OpenSSL.
However, I've been struggling to find a ...
0
votes
1
answer
35
views
Confusing notation in signature scheme
In the paper Efficient and Secure Pairing-Free Certificateless Aggregate Signature Scheme for Healthcare Wireless Medical Sensor Networks, on the signature generation part (Page 5), there is an ...
9
votes
3
answers
2k
views
Proving the possession of signature in zero-knowledge
Does anybody know an efficient mechanism to prove the possession of a digital signature (e.g. RSA) on a certain attribute (message) in zero-knowledge? That is, without revealing the actual signature (...
0
votes
1
answer
74
views
Why sbverify needs a certificate to verify digital signatures?
sbverify needs a certificate to verify digital signatures. I wonder why it's needed, since the signer certificate is already included in the digital signature itself ?
1
vote
1
answer
83
views
What non-trivial benefit does including a "context"/"signer info" provide in SM2-DSS and EdDSA?
While implementing SM2 DSS and reading RFC-8032 for EdDSA, I noticed that, both families of schemes provide provisions for including a "context" (in EdDSA) or "signer info" (in SM2 ...
4
votes
4
answers
728
views
Deniability properties of the X3DH Key Agreement Protocol
Signal's X3DH Key Agreement Protocol specification states in section 4.5.:
Alternatively, it might be tempting to replace the DH-based mutual authentication (i.e. DH1 and DH2) with signatures from ...
1
vote
1
answer
47
views
How to authenticate multiple IOT devices having unique certificates (ECDSA)?
I'm relatively new to the field of security.
I'm working on an IoT system with WiFi-connected nodes (Bio-sensing devices) communicating with a server for centralized monitoring.
I need to authenticate ...
3
votes
1
answer
132
views
Another question about equivalent keys and RSA
I've been trying to understand the multiple keys thing in RSA.
I'm quite sure that multiples private keys are possible:
In RSA, why are there multiple possible private keys, and even the public key ...
1
vote
1
answer
154
views
Generating a SHA256 pkcs1v1.5 Blind RSA Signature using Chaum's Blind Signature Scheme
I am a noob to cryptography in the sense that I have only little understanding as to how RSA encryption schemes work in practice. However I do understand the theoretical foundations of RSA ...
3
votes
1
answer
466
views
Digital signature and salt
I'm wondering whether is of any use to add salt when computing a signature of a piece of data.
I looked around but didn't find an answer to this, although there's a very similar question: Why hash or ...
3
votes
1
answer
66
views
Cost of attacking textbook RSA signature of $b$-bit hash of the message
A signature system applies textbook RSA to a $b$-bit hash of the message. What's the cost (preferably, as CPU time on common hardware) of existential forgery assuming known signature of $r$ random ...
4
votes
2
answers
263
views
Signature check decrypts ciphertext
Can somebody lead me to existing literature on making the extraction of plaintext dependent on a valid signature check first? I didn't think it was possible to force signatures to be checked; but this ...
1
vote
1
answer
104
views
How to compute a ciphertext length from a cryptographic scheme?
I am trying to understand how this ciphertext length is calculated from a signcryption scheme to analyze the communication cost. I understand, we consider the key length and the message length to ...
14
votes
1
answer
7k
views
Description of signatures with message recovery (as in ISO/IEC 9796-2 and EMV Signatures)
I'd like to get an overview of how the signatures with message recovery work, especially in case EMV and other smart card systems. Is there a nice overview available without being required to read the ...
0
votes
1
answer
130
views
Rainbow What happened to signatures in the NIST standardization process?
The rainbow signature was not seen in round 4 of the NIST PQC standardization process. Was Rainbow not shortlisted?
3
votes
2
answers
117
views
Basic, easily implementable (and small code size) algorithm for validating signature/token [closed]
I'm looking for some basic algorithm to:
generate a code
send it to a website,
where after payment a token is generated from the code and sent back,
where the token is validated.
I'm not sure how to ...
3
votes
1
answer
102
views
What is the modern terminology for a digital signature scheme with a shadow?
In Guillou and Quisquater's 1988 paper "A 'Paradoxical' Indentity-Based Signature Scheme Resulting from Zero-Knowledge", they say that an RSA identity has a shadow and go on to state that ...
1
vote
1
answer
71
views
NIZK Proof of Knowledge of a Standard RSA Signature on a message (without signer participation)
I'm looking for a protocol in which a Prover transforms a RSA signature $\sigma$ on a message $m$ that verifies under a public key $vk$ into a NIZK proof of knowledge, $\pi$ of that signature. A ...
3
votes
2
answers
147
views
What is the difference between Ring Signature and Multi User Designated Verifier Signature?
I was going through some text related to designated verifier signature (DVS). I came to know that DVS can be thought of as the two party ring signature. Can we extend this concept and say that ring ...
2
votes
1
answer
93
views
Self-contained digital certification device
Does it work if we try to construct a device (e.g., for counting purpose in several remote branches of a company) using a self-containing digital signature key enclosed in a tamper-proof hardware to ...
2
votes
1
answer
450
views
Why must ECDSA verification ensure the point is on the curve?
In ECDSA, when parsing the public key a test is made to ensure the public key really lies on the curve. What vulnerabilities appear if one does not do this?
2
votes
4
answers
2k
views
How can you verify private key ownership using a public key and message signature?
When I sign a message with a private key, and I get a message signature, how is it that I'm able to - using the corresponding public key - verify that that message/transaction signature must have been ...
2
votes
0
answers
195
views
Forging an ECDSA signature for a random public key string
An adversary is able to insert a random string (which he does not control: he can only randomly generate it and insert it). The random string is parsed by the victim as an ECDSA public key. This ...
1
vote
0
answers
91
views
SUPERCOP benchmark of signature scheme: Number of cycles of key generation
I'm having troubles in interpreting the output of the SUPERCOP benchmarks of some digital signature schemes.
Precisely, I don't understand how to read the number of cycles for the key generation. This ...
1
vote
0
answers
26
views
Single Term Off-Line Coins : Corrections on the final signatures
I am making an implementation of Niels Ferguson's paper: Single Term Off-Line Coins in Python.
In the Coin withdrawal protocol, in the last steps, Alice checks that the signatures she received are ...
1
vote
1
answer
78
views
Signing with symmetric crypto and an arbitrator, question from Applied Cryptography book
I've got the 2nd edition, 3rd printing. On page 35 it lists the steps for signing a document:
Alice encrypts her message to Bob with KA and sends it to Trent
Trent decrypts the message with KA
Trent ...
1
vote
0
answers
42
views
Can $s$ be any number in $s^x = x \bmod N$, where $N = p \cdot q$ for de Jonge / Chaum?
I was reading about some way to imagine the signature of a message using the RSA problem :
Let $N$ be the product of two prime numbers $p$ and $q$. Let $s$ be
the signature of a message $s$ (provided ...
18
votes
2
answers
4k
views
Schnorr signatures: multisignature support
Schnorr signature is mentioned as a promising upgrade to bitcoin to improve scalability. It support multisignature, several signatures can be aggregated into a single, new signature. But I fail to ...
2
votes
1
answer
190
views
Is Falcon (PQ signing algorithm) slower than ECDSA in terms of computing time?
FALCON is a cryptographic algorithm for digital signature, but is it slower than actuals algorithms (ECDSA)?
1
vote
0
answers
106
views
Recovering multiple of $\phi(N)$ given two private public key pair
Assume $\phi(N) = (p - 1) (q - 1)$ as in the original paper. Suppose that we are using the same modulus $N$ for public and private key pairs $(e_1, d_1)$ and $(e_2, d_2)$. How can we get a multiple of ...
2
votes
1
answer
271
views
Application firmware sign-then-encrypt vs encrypt-then-sign
I know that there are previous questions on the subject e.g. here, however I would like to ask it for my particular (simple) case.
I have an application firmware that is downloaded to a microprocessor ...
3
votes
2
answers
178
views
Given multiple incomplete ECDSA signatures, what can a quantum attacker learn in the following scenarios?
Assume a 256-bit ECDSA private key used with Secp256k1 and SHA-256. This key signs multiple different messages in a fully deterministic manner as described in RFC-6979, so signing the same message ...
0
votes
0
answers
46
views
What is this parameter? in Lyubashevsky's ID-scheme
I am studying Lybashevsky's ID-scheme from the article Fiat-Shamir With Aborts: Applications to Lattice and Factoring-Based Signatures(https://www.iacr.org/archive/asiacrypt2009/59120596/59120596.pdf) ...
1
vote
1
answer
629
views
ECDSA SECP256k1 curve - same-r-value-is-used-for-two-different-addresses
Edited: changing the notation according request by fgrieu.
I have prepared 4 transactions for 2 pubkeys with the same r1 and r2.
properties of secp256k1:
...
3
votes
0
answers
70
views
Proof of Lemma 1 paper " Provably Secure Partially Blind Signatures Masayuki ABE and Tatsuaki OKAMOTO"
I'm troubled by a system of equations presented in the paper "Provably Secure Partially Blind Signatures" Masayuki ABE and Tatsuaki OKAMOTO.
In lemma 1 the authors define $t_2=w_j-c_i$ ...
1
vote
0
answers
91
views
ABE and OKAMOTO definition of partially blind signature scheme
I'm trying to understand the definition of a partially blind scheme that is described with Game A presented in
Abe and Okamoto paper
In line 5 is $msg_0$ correct or should it be replaced by $(info_0,...
1
vote
0
answers
68
views
Discrepancy in secp256k1 signature generation
I'll get straight to the point here.
There are two different programs I'm looking at. They both use secp256k1 to deterministically sign data (RFC6979) & provide the results online in-browser. ...
1
vote
1
answer
53
views
Can a quantum attacker prove that incomplete ECDSA signatures were produced with the same key?
Assume a 256-bit ECDSA private key used with Secp256k1 and SHA-256. This key signs multiple different messages in a fully deterministic manner as described in RFC-6979, so signing the same message ...
3
votes
2
answers
617
views
is SHA512 with 256 bit set is similar or same as SHA256?
I'm new in Cryptography, if i will use SHA512, but only with 256 bits, is it equal or similar to SHA256?
I'm trying to understand if there is a way to use SHA512 as SHA256
1
vote
0
answers
77
views
Question about Security of Multi-Signature Scheme
I am a developer trying to follow best practice guidance as established by the IETF for my applications. I was researching standards for ECDSA key generation for some work that I have to do in the ...
1
vote
1
answer
122
views
Is there any link between group signature and multi-signature
Are both of these concepts related in someway. Can a group signature scheme be transformed into a multi-signature scheme?
2
votes
0
answers
41
views
Fusion auth versus jose4j library for jwt using secp256k [closed]
I am a beginner in-terms of JWT libraries in programming.
How the keypair used (secp256k1) is related with the algorithmic header used for creation of JWT?
And why authfusion doesn't need an ...
4
votes
1
answer
299
views
Basic explanation of Falcon and Dilithium
I've been trying to search for toy examples of the round 3 digital signatures Rainbow, Falcon and Dilithium. Not a lot of actual implementation examples are out there. What I'm searching for are ...