# Tag Info

18

This question has many problems in the way it was asked, and clearly did not come after doing some investigation. However, since this seems to be a misconception that is spreading widely, I will relate to it. It is not true that the "crypto community" (whoever that is) believes that the NSA can break RSA. In fact, if Snowden taught us anything, it is that ...

10

There are three use cases where RSA beats common ECC algorithms, such as ECDSA: Signature with verification frequent or/and by low-power devices. The verification cost of $n$-bit RSA with usual public exponents is $O(n^2)$, but the verification cost of ECC-based signatures is $O(n^3)$ (using usual algorithms). Together with simpler math, that's why RSA can ...

9

Let me first answer your actual question (and then I'll proceed to answer something slightly different that I think will be informative and helpful). Your question asks whether it's possible to use only a DSA key. Technically speaking, this is of course possible. The reason is that a DSA key has exactly the same format as an ElGamal key. No one forces you to ...

9

This is not correct, the private key $d_A$ must always be an integer. Your mistake is that you are doing modular division e.g. $\frac{a}{b} \text{ mod } n$ incorrectly. You cannot simply divide the integers and then reduce by the modulus. The correct way to do this is to compute the modular inverse of $b$ i.e. $b^{-1} \text{ mod } n$ and then compute $a*b^{-... 8 The distinction is that ECDSA solves a problem that HMAC does not. If you need that problem solved, then you need to do ECDSA rather than HMAC; if you do not, then HMAC works just as well (and is a lot cheaper). With HMAC, here is what we have: we have an authenticator that has a secret key. It takes a message, and gives that (and the secret key) to the ... 7 The correct term for bytes to be signed is “message”. Generally, it does not really matter if a message to be signed is human readable or not. Sometimes, you may also find it mentioned as “digital message”… which practically is the same and merely extends the term to explicitly hint at the fact the message is digitally stored and/or processed. References ... 5 I'd say that most of the time the signature is accompanied by the certificate of the signer. This certificate contains the public key. Most container formats such as CMS (used in S/MIME, also known as PKCS#7) or XML digsig contain specific fields that may contain certificates - and usually do. When the certificate is received the Public Key Infrastructure (... 5 It is possible to view DSA/ECDSA as an identification scheme (like Schnorr) but with a different variant of Fiat-Shamir. This gives the intuition that you are perhaps looking for. I will include an excerpt from Intro to Modern Cryptography 2nd edition (Section 12.5.2) which gives this explanation: Begin Excerpt -- Section 12.5.2 DSA and ECDSA The Digital ... 4 Assuming you manage to safely generate RSA keys which are sufficiently large, i.e. >= 2048 bits, no TLS configuration flaw on your side, and the lack of security bugs in the TLS library used by your server or the one used by the client user agent, I do not believe TLS_ECDH_RSA_WITH_AES_128_GCM can, at this point, be decrypted by surveillance agencies. Here'... 3 To add to poncho's answer (since they beat me to it!), there are several advantages to choosing HMAC over ECDSA (or RSA) if you can get away with it: Insanely better performance: signing and verifying is much faster Much simpler implementation: this is important for security (even if you're not the one doing the implementation), since more complexity leads ... 3 There is no standard way, and I think it's impossible to find universal agreement. However, it is pretty common to use lowercase letters for integers and uppercase letters for elliptic curve points. And it is very common to indicate as p the prime defining the field$\mathbb F_p$over which the curve is defined. For the order of the curve you can use$\#E(\...

3

Sure you can do. There are many lattice attacks, using your second assumption, to ECDSA (which also applied to DSA). For instance see Smart and Howgrave-Graham and Shparlinski and Nguyen. All the lattice attacks base on finding small solutions (for the ephemeral key $k$ and the private key $a$) to the signing equation $sk-ra\equiv H(m)\pmod q.$ If you have ...

3

The problem is that, imagine you sign a message $m$ using ECDSA and SHA-1 as hash algorithm. If an attacker manages to find a message $m'$ such as SHA-1$(m)$ = SHA-1$(m')$ then the computed signature for $m$ will be valid for $m'$. So the attacker can substitute $m$ for $m'$ while keeping the same signature value. The receiver who will try to validate the ...

3

One disadvantage of DSA as conventionally implemented is that the key can be compromised if signatures are created on machines with poor random number generators. In the wake of the Debian openssl fiasco this meant that any DSA key that had been used in an openssh client on an affected machine was potentially compromised. With RSA keys only keys generated ...

2

ECDH is not for signing. Your sign method using ecdh does not look like any valid signature scheme I have ever seen, and is therefore likely wildly insecure. Note that the Q&A you link to is asking a very different question.

2

ECKEY object may contain: Group Private key Public key Both Group and Private key are needed to be able to calculate signature. It is most convenient to use generic ECKEY object (from API perspective), as it easy to e.g. convert between commonly used PKCS#8 PEM encoded EC private keys and ECKEY objects, and because just a BIGNUM would not be sufficient. ...

2

What is its signature length ? Depends on what algorithms you use, but with ECDSA the signature length is twice the length of the order of the base point. For P-521 that's 1042 bits, or 132 bytes when using whole bytes for each part. For E-521 it's 1038 bits or 130 bytes. How is it better ? The design criteria for E-521 are stated in A note on high-...

2

There is a way to generate forgeries for (EC)DSA when the hash function is not one-way: Let $n$ be the order of the group, $P$ a generator, and $Q = aP$ for some secret $a$; Pick arbitrary $\alpha$ and $\beta$ $\in \{0, \dotsc, n\}$; $r = x \bmod n$, where $(x, y) = \alpha P + \beta Q$; $s = r \beta^{-1} \bmod n$; $h = s \alpha \bmod n$; Invert $H(h)$ to ...

2

Typically, a message will contain some sort of identifying information of the sender, such as the From header of an e-mail. In any case, if the sender of the message is unknown, what's the point of using signatures at all? The purpose of a signature is to ascertain that the message was written and sent by its purported sender. The only way to be 100% ...

2

Trivial solution: generate a random $k$ as part of the private key and include $r$ as part of the public key. The verifier uses $r$ from public key, so the signer must use the same $k$ for every valid signature. The signer could create multiple related public keys and reuse $D_A$, but then, they might as well just create multiple key-pairs in the first ...

2

You are probably aware of the existence of public key certificates. A certificate proves the authenticity of a public key, basically by signing the value of that public key (plus some data on the owner of that key) with a private key of some third party. This third party often is a central Certificate Authority (CA) that is trusted by both the sender and the ...

2

I think that I've found a good solution to this problem. In short terms it consists in generating an ECDSA signature using the point $R$ as generator, $s$ as private key and the result of $s*R$ as public key. So the $r$ part of the signature would be revealed but the $s$ part is still kept secret. The usual ECDSA signature generation consists in proving ...

2

Well, it makes the discrete log problem easier; hence it makes recovering the private key easier The DSA private key is a value $k$, and his public key is the value $g^k \bmod p$. $g$ has order $q$; if $q = q_1 \cdot q_2$, then the attacker can compute $(g^k)^{q_2} = (g^{q_2})^k$. The value $g^{q_2}$ has order $q_1$, and so he can solve that problem in $O(\... 2 I'm not sure, but I guess that two different openssl version or just builds could be done with or without support of Elliptic Curves with unsecure security levels. Furthermore your curves have very low security level, and you shouldn't use them if security is a concern (and if it's not, you probably don't need ECDSA at all). However, your assumption that "... 2 Asn1parse to the rescue. Most of the overhead is from the base64 encoding and the PEM header and footer. The raw size of the compressed form ASN1 encoding is just 44 bytes for my dummy key. And 22 of those bytes are for the 161 bits of the actual public key.$ openssl asn1parse -in compressed_public.pem -i -dump 0:d=0 hl=2 l= 42 cons: SEQUENCE ...

2

1) If I'm using it to sign a hash that I've already created (HMAC-SHA-384-192, specifically) a) why must I specify another hash algorithm? HMAC is not a hash algorithm. It's a MAC, a message authentication code, or keyed hash. As the private key is used to create the signature there should not be any need for the secret key used to create a HMAC ...

2

No, you do not add the ASN.1 encoding to the hash when generating an ECDSA signature. There are two reasons for this: The first is that there is no room, if we select a curve and a hash with equal security. To be secure against attacks that take $O(2^N)$ time, a curve needs to have a prime that's at least $2N$ bits; to be secure against collision attacks ...

2

If attackers can strip off RSA / EC / -DSA digital signature and conduct CCA on AES-CTR or CBC payload, why can't they do the same for AES-GCM? The scenario, you're talking about is iMessage or Signal Protocol or other protocols which allow optionally to sign the ciphertext and thereby don't MAC it. The problem here is a) that you could replace the ...

1

That wikipedia article is about TLS, and lists separately only EC curves that have assigned numbers in TLS; for TLS all other curves fall under "arbitrary prime" or "arbitrary 2^m". OpenSSL supports for non-TLS operations including ECDSA quite a few curves not numbered for use in TLS, including the three you list. As requested, I do not comment on their ...

1

As was noted in the comments the reason for $q$ having to divide $p-1$ is Lagrange's theorem: Lagrange's theorem [...], states that for any finite group $G$, the order (number of elements) of every subgroup $H$ of $G$ divides the order of $G$. In the case of DSA we are working in subgroups of $\mathbb F_p$ (which has order $p-1$). By Lagrange's ...

Only top voted, non community-wiki answers of a minimum length are eligible