Algorithms and protocols for creating signatures to documents, and verifying such signatures. These are normally asymmetric, for symmetric signatures see [mac].

learn more… | top users | synonyms

1
vote
1answer
72 views

setting the MGF hash to a different value other than the regular hash with openssl for PSS signatures

In PKCS1's Probabilistic Signature Mode you have the Hash and the MGF Hash. Both appear to be, by default, sha1, with the OpenSSL CLI client, however, I can change it to sha256 with the following: <...
1
vote
1answer
79 views

Which hash function is usually used in RSA?

I know there are several available, however I can't seem to find whether there is one standard one or not. I think I understand the process of digital signatures, just wondering which has function is ...
1
vote
2answers
206 views

How is message length involved in public/private-key encryption?

I've just read this question regarding why to sign only the hash of a message. I kind of understood the answer, but the question arisen is now: Why can I encrypt any text messages with the same ...
1
vote
1answer
60 views

Signature Verification: High level

I'm trying to understand how certificate signing and verification works conceptually. I know the classic example with asymmetric cryptography- the sender encrypts data with public key of receiver, ...
1
vote
1answer
70 views

Can Winternitz be easily converted to a many-time encryption scheme?

The Winternitz scheme is typically cited as being an OTS scheme. Can it also be used as a one-time encryption scheme? If it can be used as a one-time encryption scheme, then is it possible to easily ...
1
vote
1answer
114 views

RSA padding confusion attacks

Server A produces signed messages on request. You can tell server A what type of RSA padding to use in the signature (either RSASSA-PKCS1v1_5 or RSASSA-PSS). Either way, the message will be signed ...
1
vote
1answer
241 views

How do SignRecover and VerifyRecover work?

In PKCS#11, there are the SignRecover and VerifyRecover methods, where the data can be recovered from the signature. How do these methods work? Can I implement signrecover and verifyrecover with ...
1
vote
1answer
76 views

Showing that security of a elgamal invariant is insecure

Original Elgamal signature is defined $S(m, \alpha) = (r, s)$, where $$r = g^k \bmod p$$ $$s = (m – r*α)k^{-1} \bmod (p – 1)$$ more information on Elgamal signature can be found here. Variant ...
1
vote
1answer
226 views

Can I use asymmetric encryption for more powerful write-protection?

I have a game that I am developing which uses a locally-stored internal database. It does not matter to me whether a user can read the file (which, to me, means I don't need a symmetric cipher), but I ...
1
vote
1answer
253 views

Non-interactive Zero-knowledge proof signature validation without public key

I'm looking for a method for a scenario with following requirements: At least 3 people (A,B,C,...) are in a Network where they can broadcast messages to everyone but not communicate with a specific ...
1
vote
1answer
431 views

Digital signatures under plain RSA

Show that digital signatures under plain RSA are insecure (Plain RSA means that signing is done by calculating $m^d\bmod n$, with $0\le m<n$, and no padding or hashing of $m$). Write an algorithm ...
1
vote
1answer
115 views

Is there a method to combine encryption and ring signing?

There's the well-known question on whether to sign or encrypt first. However, if instead a message is to be ring-signed such that either recipient could be the actual signer, is there any scheme that ...
1
vote
2answers
535 views

Shamir's ID based signatures

I am currently implementing Shamir's ID based signature algorithm as proposed in Adi Shamir, Identity-Based Cryptosystems and Signature Schemes. Advances in Cryptology: Proceedings of CRYPTO 84, ...
1
vote
1answer
227 views

ElGamal encryption with private key [closed]

Does the encryption with a private key and decryption with a public key works in ElGamal likewise what is done when we use RSA for sender authentication?
1
vote
1answer
246 views

Difference between implicit signature and explicit signature

In most of time, what I see is explicit signatures such as ElGamal, it's rare to see the implicit signatures. So I wonder why it's rare to be seen? what aspect is it mainly used? what's the ...
1
vote
1answer
434 views

Can you explain partial private key extract algorithm in certificateless Public key cryptography?

Related to the algorithms of certificate-less Signature approach of Al-Riyami and Paterson… Why is there a need for a "partial private key extract algorithm"? Why should it be needed when ...
1
vote
1answer
341 views

Is there proof to the relation between the gap Diffie-Hellman problem and the the Cha-Cheon signature scheme?

I am trying to prove that: "If the gap Diffie-Hellman problem is easy, then the Cha-Cheon signature scheme will be broken." Can you help me to prove it? Is there any proof to the relation between ...
1
vote
1answer
65 views

Design question for a service that signs messages on behalf of a user

I'm working on a messaging service that lets users author messages and have them signed with an RSA key. The key is used for identity purposes only and can be revoked, so compromising the private key ...
1
vote
1answer
48 views

Expire signature

I am looking for a way to have a 'did it expired' key. There's a similar question here, but I have to prevent reusing of the 'did it expired' signature . A possible solution would be a two one-way ...
1
vote
1answer
26 views

Single-scalar multiplication with sign bit

I want to know if there's an "easy" timing-free way to compute the sign of $y$-coordinate of $r G$, for a secret scalar $r$ and $G$ the generator of an elliptic curve. We have several choices for ...
1
vote
1answer
63 views

Why are there $q^2$ keys for each equivalence class in Pedersen-van Heyst Signature Scheme?

How do you know there are $q^2$ keys for each equivalence class in the Pedersen-van Heyst Signature Scheme? My textbook says this is "easy to see", however, I am not seeing it. Is it because in the ...
1
vote
1answer
82 views

Better security than SHA1 for signature?

An application that I maintain uses Sparkle Update to update itself. I expect attacks from high level attackers (China, USA's NSA, etc.) and have some questions about how secure the cryptography ...
1
vote
1answer
49 views

Universal reencryption for signatures

Universal reencryption is an interesting encryption primitive. Attempts to build signatures schemes or protocols with authentication incorporating it have frequently failed though. A plausible ...
1
vote
1answer
54 views

Can the original message be retrieved from a public/private key signature?

When I sign a message (which has potentialy low entropy) using a private key and I send it without the original message, can the original message be retrieved from the signature(s)? I want to prove – ...
1
vote
1answer
43 views

Digital signatures using a partially public key

I'm thinking to sign a message using a key that is made up of a publicly shared key and a privately shared key. The operation for mixing the two keys could be concatenation, if it suffices. To ...
1
vote
2answers
239 views

On the fly signatures and zero-knowledge

I am reading some articles which explain on the fly signatures (also called online/offine signatures). The principle is that a few operations do not depend of the message we want to sign, so these ...
1
vote
1answer
33 views

Why does P1363 require RW signature with $0 ≤ s < n/2$?

I'm using an older copy of P1363 Public Key Cryptography was used below. It may (or may not) reflect the current state of affairs. P1363 has the following requirement in section 8.2.8 IFSP-RW, p. 45: ...
1
vote
1answer
96 views

Tweaked Square Roots and Rabin-Williams

I'm reading Bernstein's RSA signatures and Rabin–Williams signatures: the state of the art. In section 6, Bernstein states: Recall that Rabin’s system needed to try several values of r, on ...
1
vote
1answer
69 views

Are digital signatures using preprocessed paper pads possible?

My idea was, given that a computer could produce some sort of lookup tables on paper, could then a human use those lookup tables to create a system for digital signatures? This was really an idea for ...
1
vote
1answer
76 views

Rabin-Williams, blinding and size of Integer r?

I was reading the paper Breaking the Rabin-Williams digital signature system implementation in the Crypto++ library. The library uses blinding, but it was not enough to stop key recovery. But my ...
1
vote
1answer
167 views

RSA-blind signatures vs. DSA-blind signatures

I see that the RSA blind signature scheme tends to be implemented more often than others, e.g., DSA blind signatures. Isn't the RSA blind signature scheme a 'lesser' scheme, if you may, compared to ...
1
vote
1answer
413 views

Using C_Sign to create a PKCS7 signature

I am using the PKCS#11 function C_Sign to sign some data. The output I get is just a signature. How do I get it in PKCS#7 format - i.e. ASN1 with signature and certificate (for detached) or ASN1 with ...
1
vote
1answer
70 views

Verifying signature owner (without verifying the actual document)

Programming in Java. I have an RSA key-pair, a document, and a signature created with the Java Signature class, using SHA512WithRSA. In order to verify the signature, of course, I need to provide the ...
1
vote
1answer
129 views

Ed25519 with R replaced by H(RAM)?

Ed25519 signatures consist of $(R, s)$, where $s = r + H(RAM)a$ $mod$ $l$, and $R = rB$. This differs from the Schnorr signature where instead of $R$, the signature contains the hash $h=H(RAM)$. ...
1
vote
1answer
84 views

Is there an anonymous non-interactive authorisation scheme with peer-side auth. signature generation?

I implemented a pseudonymous PKI scheme (by K. Zeng @Springer Link), where all peers can change their public keys including its signature on their own. I am looking for a way to extend it with some ...
1
vote
1answer
135 views

how to use salt to sign a message and how is it effective? [duplicate]

I've had an assignment to sign a file using hash and salt, so I read about salt and I got why it's important when it comes to password, but not to sign messages. How do I sign something using salt? ...
1
vote
2answers
123 views

Shamir's ID based signatures - Notation issues

I am currently implementing Shamir's ID Based signature scheme as defined in the original paper (archive link). The sign and verify operation are defined as follows: Sign: $s = g * r^{f(t,m)} (\mod n)...
1
vote
1answer
329 views

How do I sign data that's been encrypted using public key? (RSA)

I've received a public key to encrypt my data for the other end to decrypt using their private key. Now, they want us to sign the data as well to ensure non-repudiation. I thought that I should only ...
1
vote
1answer
201 views

Security Consideration on The Use of Random Number in Digital Signature

key-exchange protocol allows two parties to establish a shared key over public network. Lacking of authentication the original Diffie–Hellman key exchange is insecure under man-in- -the-middle ...
1
vote
1answer
120 views

Merkle signature + PRNG?

In the section 3 (page 44) of the book "Post Quantum Cryptography", it says: Then each one-time signature key must be generated twice, once for the MSS public key generation and once during the ...
1
vote
0answers
20 views

How do I prove the tracing part in a ring signature model?

I have a question about the article “efficient and multi-level privacy-preserving communication protocol for VANET” by H. Xiong et al. I need the ID of malicious vehicle, but I could not prove how I ...
1
vote
0answers
49 views

Given a public-key encryption and signature scheme, define a new primitive

I'm new to cryptography and am currently working on the following question: Say you are given a public-key encryption scheme $\Pi_e=(\mathcal{K}_e,\mathcal{E},\mathcal{D})$ and a signature scheme $...
1
vote
0answers
56 views

How to check the signature without the predetermined function in ECDSA from openssl?

I'm developing a client for a two-factor authentication in Qt/C++ under openSUSE 13.2, 64bit. I've got the FIDO U2F Security Key from yubico/fido. I'm using the classes from openssl, in particular <...
1
vote
0answers
16 views

Remotely Verify File Timestamp

I'm working for a professor to build a platform for students to take midterms and finals online. The student downloads the test during class (when the professor makes the test available on the server ...
1
vote
2answers
115 views

Is signing a plaintext sufficient?

If I have N bytes of plaintext, does signing it with my private key prove (to holders of my public key) that I have signed that exact plaintext messages? i.e. could an attacker use the plaintext and ...
1
vote
0answers
255 views

How do I create a PKCS#7 or CMS SignedData in python? [closed]

There doesn't appear to be PKCS#7 or CMS support in pyCrypto. I'd appreciate a recommendation on a Python library wth CMS / PKCS#7 support. Ideally, there will be a call that will create return ...
1
vote
0answers
47 views

One-Time-Signature based codes

I'm trying to understand the sentence in bold, in the follow paragraph of A new one-time signature scheme from syndrome decoding Keygen: Given a security parameter $\lambda$, choose a suitable ...
1
vote
0answers
81 views

How far is public-key crypto involved in “banking world”? [closed]

I would like to know how public key cryptography is used in the banking world. I am not looking for big details, but for example: Are banking card embedding a private key used for signing (...
1
vote
0answers
73 views

RSA Signature Forgery

We all know that x509 certificates carry a signature that represents the certificate digest encrypted by the private key of the issuer. I believe that the digest is encrypted only providing one block,...
1
vote
0answers
45 views

Digital signature in a group chat scenario?

I understand that RSA is great for 1-to-1 digital signature. In the group chat of N people, other than storing and maintaining N public keys, is there a simpler way of authenticating each and everyone ...