# Tag Info

5

I'd say that most of the time the signature is accompanied by the certificate of the signer. This certificate contains the public key. Most container formats such as CMS (used in S/MIME, also known as PKCS#7) or XML digsig contain specific fields that may contain certificates - and usually do. When the certificate is received the Public Key Infrastructure ...

5

The distinction is that ECDSA solves a problem that HMAC does not. If you need that problem solved, then you need to do ECDSA rather than HMAC; if you do not, then HMAC works just as well (and is a lot cheaper). With HMAC, here is what we have: we have an authenticator that has a secret key. It takes a message, and gives that (and the secret key) to the ...

4

Assuming you manage to safely generate RSA keys which are sufficiently large, i.e. >= 2048 bits, no TLS configuration flaw on your side, and the lack of security bugs in the TLS library used by your server or the one used by the client user agent, I do not believe TLS_ECDH_RSA_WITH_AES_128_GCM can, at this point, be decrypted by surveillance agencies. ...

3

To add to poncho's answer (since they beat me to it!), there are several advantages to choosing HMAC over ECDSA (or RSA) if you can get away with it: Insanely better performance: signing and verifying is much faster Much simpler implementation: this is important for security (even if you're not the one doing the implementation), since more complexity leads ...

3

As otus already stated in his comment, the correct term for bytes to be signed is “message”. Generally, it does not really matter if a message to be signed is human readable or not. Sometimes, you may also find it mentioned as “digital message”… which practically is the same and merely extends the term to explicitly hint at the fact the message is digitally ...

3

There is no standard way, and I think it's impossible to find universal agreement. However, it is pretty common to use lowercase letters for integers and uppercase letters for elliptic curve points. And it is very common to indicate as p the prime defining the field $\mathbb F_p$ over which the curve is defined. For the order of the curve you can use ...

2

Typically, a message will contain some sort of identifying information of the sender, such as the From header of an e-mail. In any case, if the sender of the message is unknown, what's the point of using signatures at all? The purpose of a signature is to ascertain that the message was written and sent by its purported sender. The only way to be 100% ...

2

You are probably aware of the existence of public key certificates. A certificate proves the authenticity of a public key, basically by signing the value of that public key (plus some data on the owner of that key) with a private key of some third party. This third party often is a central Certificate Authority (CA) that is trusted by both the sender and the ...

2

Trivial solution: generate a random $k$ as part of the private key and include $r$ as part of the public key. The verifier uses $r$ from public key, so the signer must use the same $k$ for every valid signature. The signer could create multiple related public keys and reuse $D_A$, but then, they might as well just create multiple key-pairs in the first ...

1

Strictly speaking EdDSA, as defined in "EdDSA for more curves" by Bernstein, Lange et al., can only work for (twisted) Edwards Curves. Thus, IMHO, the correct answer your question is no. In the paper, they define the curve parameters as being the parameters of a (twisted) Edwards curve, the addition law as the addition law on twisted Edwards curves, etc. ...

1

Not great answers but something: If you just want the mathematical computations, indepedent of implementation, Wikipedia has a good explanation, and the standard is definitive. Java JCE source is open. The repository is git (which I don't have set up); Oracle(Sun) JDK distribution has src.zip but exclude the JCE part; JRE distribution has no source at all. ...

1

There are no relation we are currently aware of. The reason is as follows. The map $$k \mapsto (k G).x$$ is assumed to be a good pseudo random number generator. (The NSA infiltration of the Dual EC drgb has nothing to do with that fact). This basically says that k and r can be seen as independant random variables.

1

I assume the recommended approach is to use a KDF function like HKDF, but what is the security implication of taking an SHA-256 hash and using it directly for AES-256 or truncating it for AES-128 (Alice and Bob are using Java which doesn't have a native implementation of HKDF and I don't think it is a good idea to try and write your own). HKDF(-Expand) ...

1

There is no standard (let alone correct) notation for elliptic curves, or anything else for that matter. It is up to each author to precisely state which notation is used for what.

Only top voted, non community-wiki answers of a minimum length are eligible