Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].

learn more… | top users | synonyms

1
vote
1answer
115 views

Difference between implicit signature and explicit signature

In most of time, what I see is explicit signatures such as ElGamal, it's rare to see the implicit signatures. So I wonder why it's rare to be seen? what aspect is it mainly used? what's the ...
1
vote
1answer
83 views

Sample RSA-style signature confusion

I'm trying to study a simplified TLS-style protocol, including verifying RSA signatures. It's an attempt to verify using only a valid certificate. However, I can't manage to get anything to verify ...
4
votes
3answers
185 views

Why can an RSA signature be authenticated ONLY with the signer's public key?

I'm an undergraduate Math student currently taking a cryptology course. I have a question about the RSA signature authentication mechanism. An RSA signature can be authenticated with the public key ...
6
votes
2answers
712 views

Using the same RSA keypair to sign and encrypt

The RSA signature operation is basically the same as encrypting with the private key. In particular, both operations use the same kind of keys. Is it safe to use the same RSA keypair both for ...
4
votes
3answers
171 views

Why use a timestamp and how can someone know it's the correct one?

Let's say A wants to send a message, so everyone who gets the message, can be assured that it's from A. A then sends a message ...
0
votes
0answers
29 views

Finding ECDSA public key from signature samples [duplicate]

How many plain ECDSA signature samples are needed to guess the corresponding public key from it like RSA? Otherwise, is it impossible to guess public key from ECDSA signature/encryption messages?
3
votes
1answer
92 views

What is the impact of the Goppa code distinguisher on the CFS and McEliece?

What is the impact of the distinguisher for the high-rate Goppa codes (as published in "A Distinguisher for High Rate McEliece Cryptosystems") on the CFS signature scheme and the McEliece/Niederreiter ...
1
vote
1answer
159 views

What is a Trapdoor in Merkle Signature?

Merkle signature (pag. 40) use than public key (verification key) the root of the Merkle Tree and than private key (to sign) the set of pre-images of the $g(Y_i)$ where $Y_i$ is the verification key ...
1
vote
0answers
83 views

Generating a valid signature on El-Gamal without knowing the private key

Suppose we are given $p$, the large prime, $g$ which is the primitive root for $p$, $b$ which is calculated as $b=g^x$ mod $p$ where $x$ is the private key and $0<x<p-1$. Also suppose we know ...
3
votes
2answers
133 views

Merkle Tree High Tree

I'm reading Merkle tree signatures and I like know if the security of the that scheme depends, also, of the high of the tree or only depends that hash function is resistant to collision?
1
vote
1answer
240 views

Can you explain partial private key extract algorithm in certificateless Public key cryptography?

Related to the algorithms of certificate-less Signature approach of Al-Riyami and Paterson… Why is there a need for a "partial private key extract algorithm"? Why should it be needed when ...
1
vote
1answer
176 views

How do I sign data that's been encrypted using public key? (RSA)

I've received a public key to encrypt my data for the other end to decrypt using their private key. Now, they want us to sign the data as well to ensure non-repudiation. I thought that I should only ...
2
votes
1answer
66 views

How to pass an arbitrary signature to a certificate

I am trying to sign certificate (X509) using secret sharing. That is shareholders combine their signatures to produce the final signature which will be in this case the signed certificate. However ...
2
votes
1answer
277 views

RSA 896 vs 1024 vs 2048 in Javascript?

I am currently working on a secure messaging website and I had been using RSA 2048 for encryption, decryption and signing of messages but I found it to be EXTREMELY LAGGY so i've moved to 1024. I did ...
2
votes
1answer
419 views

How is digital signature different from a message authentication code (MAC)?

I know the definitions of both but can't specifically tell how they are different and if one is better than the other. Please help.
1
vote
1answer
159 views

Is there proof to the relation between the gap Diffie-Hellman problem and the the Cha-Cheon signature scheme?

I am trying to prove that: "If the gap Diffie-Hellman problem is easy, then the Cha-Cheon signature scheme will be broken." Can you help me to prove it? Is there any proof to the relation between ...
2
votes
1answer
96 views

Verifying a Signature

Alice publishes $(n,e)$ where $n$ is exponential modulus and $e$ is the public key. We have $n=80$ digit number and $e=3$. Bob, in correspondence with Alice, asked Alice to prove she is really Alice, ...
1
vote
1answer
281 views

Simple digital signature example with number

I've been looking for a simple which signs a number with some randomly generated key and then verified(decrypts the original number) with the public key, which is generated by the private. All the ...
1
vote
1answer
345 views

What does an RSA signature look like?

I am using OpenSSL libs to generate signatures. Internally, I learn that a signature is a hash of the message with some padding added to it. I am trying to understand the structure of a signature. If ...
1
vote
1answer
163 views

Security Consideration on The Use of Random Number in Digital Signature

key-exchange protocol allows two parties to establish a shared key over public network. Lacking of authentication the original Diffie–Hellman key exchange is insecure under man-in- -the-middle ...
1
vote
2answers
2k views

Is javascript RSA signing safe?

I'm currently working on a secure open source messaging system (https://github.com/DSMNET/DSMNET). Currently I'm using the cryptico.js (https://github.com/wwwtyro/cryptico) library to encrypt all the ...
1
vote
0answers
70 views

LogSpace Merkle Traversal

I am studying LogSpace Merkle Tree Traversal algorithm in "Post Quantum Cryptography". I don't understand the Table 1 on page 58. My question is: Why within of the $2^h$ rounds for $NEED_h$ exist ...
5
votes
1answer
319 views

What signature schemes allow recovering the public key from a signature?

It seems to be possible to retrieve the (public) key used for creating an ECDSA signature just from the signature alone. This seems like an interesting property; as far as I know, RSA doesn't share ...
4
votes
0answers
325 views

Reasons for Chinese SM2 Digital Signature Algorithm

In the IETF RFC draft named "SM2 Digital Signature Algorithm" a signature algorithm is specified. The RFC does however not mention why this signature algorithm has been defined. Nor does it specify ...
8
votes
1answer
6k views

How does RSA signature verification work?

I understand how the RSA algorithm works for encryption and decryption purposes but I don't get how signing is done. Here's what I (think) I know and is common practice: If I have a message that I ...
1
vote
2answers
185 views

What security flaw exists in MAC authentication scenario?

What security flaw exists (if any) in the solution of this non-encrypted authentication scenario? An unencrypted message passes one-way from computer A to B. Its transmission is viewable by the ...
4
votes
2answers
193 views

Fractal Merkle Traversal

I am studying Fractal Merkle Tree Traversal algorithm in this book. In the [pag. 54] I don't understand this paragraph: We may determine the number of pebbles returned at these times by ...
0
votes
1answer
281 views

How does certificate-based encryption solve key revocation problem?

How does certificate-based encryption solve key revocation problem? For example, if a user accidentally reveals its secret key or an attacker compromises it, the user may request revocation of its ...
2
votes
1answer
116 views

Verify Messages to Embedded Device

I'm building an embedded device that I plan on distributing. Periodically the device will poll my server to check for updates and commands. I'd like the device to verify that any messages(JSON strings ...
2
votes
1answer
507 views

CKM_RSA_PKCS vs CKM_RSA_X_509 mechanisms in PKCS#11

What is the exact difference between the CKM_RSA_PKCS and CKM_RSA_X_509 mechanisms in the PKCS#11 v2.20 specification (Please ...
6
votes
1answer
330 views

understanding forking lemma

Every time when I read a paper that has digital signature, when it comes to prove the security of a digital signature scheme, many chances that the author will use the forking lemma. The forking ...
6
votes
1answer
128 views

Cryptography used for login and signing transactions

My bank uses a smartcard reader (separate module not connected to the computer) as depicted below: When I need to log into my account it provides me with a challenge and I need to provide some ...
2
votes
1answer
448 views

Digital Signature size requirement

What is an approximate length for a digital signature (SHA) given the following? Using RFID tags, size ranging from 100 to 2000 bytes (8000 bits), our project is setting aside a portion for a digital ...
1
vote
1answer
152 views

Merkle Signature Generation

In the section 2 (page 42) of the book "Post Quantum Cryptography", it says: Then he generates the one-time signature $\sigma_{\text{OTS}}$ of the digest using the $s$-th one-time signature key ...
0
votes
0answers
161 views

How to safely sign a 6 characters String?

I have to decide, whether a document, which I am given, was correctly signed by a private key. my Ideas is to sign the document id using RSA with the private key and to print the following onto the ...
2
votes
0answers
88 views

BLS signatures in the G-valued Random Oracle Model

This paper on semi-generic algorithms considers "non-standard properties of the employed hash function". For BLS signatures whose main group is $G$, I'm curious what can be shown when the hash ...
1
vote
1answer
99 views

Merkle signature + PRNG?

In the section 3 (page 44) of the book "Post Quantum Cryptography", it says: Then each one-time signature key must be generated twice, once for the MSS public key generation and once during the ...
3
votes
1answer
244 views

Relation between attack and attack model for signatures

I would like to know: What is the relationship between an attack and an attack model. For example, let $\Pi$ be the Lamport signature scheme. This signature has it's security based on the one-way ...
1
vote
2answers
289 views

DSA, RSA, ECDSA etc - which one is cheapest for signing?

For a protocol where the server presents its signature to prove authenticity (e.g. IKE/SIGMA/STS with only one party authenticated), it's essential that the signing is extremely cheap, while ...
2
votes
1answer
327 views

Winternitz One-Time Signature

I am reading the page 38 in this "Post Quantum Cryptography" book (Equations 8 and 9). My question is, why to compute the verification key $Y$, $f$ is applied $2^w-1$ times? Are there any security ...
2
votes
1answer
136 views

Using plain Diffe-Hellman for server authentication with known public key

Other considerations aside, is it possible to use DH with an established public key (together with fixed g, p, q) to safely authenticate a server instead of using some signing algorithm? In other ...
3
votes
1answer
214 views

Quantum resistance of Lamport signatures

The Lamport-Diffie signature scheme is said to be quantum-resistant. Why is that? What would a quantum attempt to attack this signature scheme look like, and how does it fail?
3
votes
1answer
98 views

Signing an integer, which may be increased

I have a 64 bit integer. It has some sort of signature so that one can be sure it is valid. Anyone may increase the integer, update the signature, and remove all trace of the old signature. But it is ...
7
votes
2answers
405 views

Given a message and signature, find a public key that makes the signature valid

Given a message $M$ and a signature $S$, is it feasible to find a RSA public key $(n,e)$ such that $S$ verifies as a valid signature on $M$ (using this public key)? What if we're given one public key ...
1
vote
2answers
150 views

Digital Signature Scheme Count

My question is How I will be able to count digital signature Scheme that can sign many documents with one private key. There are signature scheme as long as exists private keys in the keys spaces? or ...
-1
votes
1answer
328 views

Verify Signature Failed [closed]

I am writing a small module which will verify signed message. Message will be signed using private key in Smart Card. The inputs are: Signed Message Original Message Public Key / Certificate with ...
1
vote
0answers
71 views

Password checking algorithm

I'm trying to reverse engineer key exchange protocol and faced with the following problem: Protocol is based on Diffie-Hellman key exchange method: g - generator m - modulus Alice: a - private key $A ...
1
vote
0answers
45 views

Conditions for proving that a signcryption scheme is secure

If I'm able to prove that any scheme satisfies confidentiality ad unforgeability conditions, will it be a valid signcryption scheme, without explicit signature and encryption parts ?
2
votes
1answer
207 views

Why is verification using DSA slower than verification with RSA?

We read in literature that verification of a digital signature is slower using DSA than if we used RSA. Why is this? DSA parameter generation: choose prime number $p$ choose prime number $q$ such ...
7
votes
2answers
221 views

Linkable ring signature scheme

I need an implementation of linkable ring signature, a ring signature which allows identifying whether two signatures belong to the same signer. It has important privacy-related applications, like ...