Hot answers tagged dsa
6
DSA stands for "Digital Signature Algorithm" - and is specifically designed to produce digital signatures, not perform encryption.
The requirement for public/private keys in this system is for a slightly different purpose - whereas in RSA, a key is needed so anyone can encrypt, in DSA a key is needed so anyone can verify. In RSA, the private key allows ...
5
According to How PGP Works it uses a hybrid approach that generates a secret key for symmetric encryption. The wikipedia page for GPG then indicates that CAST5, Camellia, Triple DES, AES, Blowfish, and Twofish are the supported ciphers.
4
Computations on elliptic curves are more efficient. Roughly speaking, when the base field has size $n$ (for DH/ElGamal/DSA, the size in bits of the modulus $p$; for elliptic curves, the size of the field for point coordinates) and a "security level" $t$ (e.g. $t = 80$ for "80-bit security" as can be expected when using a 160-bit subgroup and a 160-bit hash ...
4
The discrete logarithm problem can be attacked with either a specific or a generic algorithm. A specific algorithm is one that tries to exploit structural weaknesses of the specific group in which discrete logarithm is used; e.g. Index Calculus when we are talking about exponentiation modulo a big prime. Generic algorithms only use the group law and thus ...
4
You got three equations with two unknowns ($k$ and $x$). You only need two signatures to solve the private key $x$:
$s_1k \equiv h_1 + xr_1 \pmod q$
$s_2k + s_2 \equiv h_2 + xr_2 \pmod q$
This might be solved using Gaussian elimination. Step 1:
$s_1k/r_1 \equiv h_1/r_1 + x \pmod q$ - Divide 0.1 by $r_1$
$s_2k + s_2 - s_1kr_2/r_1 \equiv h_2 - ...
4
In DSA (and ECDSA), it is possible and common to share the same domain parameters, across multiples users. AFAIK (and according to common wisdom, including FIPS recommendations) this introduce no known security weakness. The only common reasons to change domain parameters are to increase key size, or purposely introduce on interoperability barrier (e.g. to ...
4
One rationale for avoiding randomized schemes in general, and in MACs in particular, is that the random in such schemes tends to increases the size of cryptograms or reduce the size of the payload. An example is scheme 2 in ISO/IEC 9796-2 RSA signature with message recovery, where the size of the random/salt field is directly antagonist with the amount of ...
3
It depends how you define what a "public key" is.
Typically it is the value of the key itself ($y$), plus information about the group (safe prime $p$, subgroup size $q$, generator of subgroup $g$). For signing a message, you do not need the value of the public key itself. So if you are strict in defining a "public key" to only be $y$, it is not needed to ...
3
Well, no, it is not safe to use a GCM authentication tag as a hash. If you know the key, it is straight-forward to find preimages; that is, find a message that hashes to a specific target value. Note that you asked for second preimage resistance; not only does it fail to provide that, it fails to provide the weaker preimage resistance.
CCM and OCB have ...
2
Elliptic Curve Cryptography (ECC) is not known to be specifically more resistant to side channel attacks (of course the next question is more resistant than what).
This paper reviews power analysis side-channel attacks against ECC and countermeasures.
Given that ECC uses multiplication and many common implementations of the MUL instruction run in time ...
2
If the messages are unknown, there are no two messages $m_i, m_j$ such that $m_i = m_j$ and the messages have sufficiently high entropy (which might be shared across several messages, if the hash function is a CSOWF and the messages e.g. have low entropy unique sub strings or are made unique in some other way), and the underlying hash function is secure in a ...
2
So I actually asked the theoretical version of this question a while ago: what happens if you choose multiple keys from the same group?
The answer, as best as I determined, is its still secure. First, this practice is used both in the Internet Key Agreement Protocole (IKE) in IPSEC, and for SSH.
Second, the best algorithms for breaking DSA effectively ...
1
Selecting domain parameters for assymmetric schemes such as DSA or ECDSA is a tricky task ( involves good prime number number generation, point counting algorithm ect).
That means that most people aren't able to choose their own. Knowing that fact most standards publish, for each security level, a small set of parameters that everybody can use.
In general ...
1
I'm considering switching to ECDSA, would this require less space with the same level of encryption?
The answer to that question is yes, both ECDSA signatures and public keys are much smaller than RSA signatures and public keys of similar security levels. If you compare a 192-bit ECDSA curve compared to a 1k RSA key (which are roughly the same security ...
1
Original Answer (StackOverflow)
Haven't got enough time to look up the details, but I would guess that you're applying (or not applying) padding correctly. That would cause the right result to come up for some input lengths, but not for others.
I guess I'll look into this more, but I wanted to get something in under the bounty wire :)
Edit: Ok, ...
1
Regarding your first question, it is my understanding that DKG techniques are in practice mainly used for offline signing, such as when a certificate authority issues new intermediate CA certificates. Using DKG for online signing, such as server side SSL/TLS, is not a problem that is solved by the papers you refer to, since the threat scenario is ...
Only top voted, non community-wiki answers of a minimum length are eligible
