# Tag Info

Actually you have a bug in your step of key generation, it should be $Q_A=d_A \times G$ and you want to have a point $G$ of large prime order $n$ such that the ECDLP is hard on the group. The last check ensures that the public key $Q_A$ is a point of order $n$. If this is the case, then $Q_A\times n = (d_A \times G)\times n = d_A\times(n\times G)=d_A\times ... 2 Yes. We can easily generate the malicious public key as in DSS case. The following attack was proposed in Section 4.5 of Blake-Wilson and Menezes: Unknown Key-Share Attacks on the Station-to-Station (STS) Protocol (PKC 1999). Let$(G,q,n,P)$be the ECDSA parameters, where$n$is the order of the group$G$over the elliptic curve and$P$is a generator of ... 4 First of all I do not know your implementation, but it seems that you have some basic misunderstandings. Signature: ECDSA(sha256(Data) ) ECDSA is typically implemented in a way that you do not explicitly hash the data prior to passing it to the signing algorithm (but as this might be your own implementation and signing may still work correctly). ... 2 I'll start with the last point and use the notation for ECDSA from the wikipedia article. Does it make any more difference if there is data that is known to have been signed by the private key and the signature(s) are known and the raw data is known? When using a digital signature scheme, the parameters (used group, e.g., elliptic curve group) as well ... 2 Use a zero-knowledge proof of knowledge (ZKPoK) of a value$(r,s)$that is a valid signature. For instance, you might be able to adapt existing ZKPoKs for proof of knowledge of a discrete logarithm to this problem. Because it is zero-knowledge, you will know that it reveals nothing about$(r,s)\$ and is not transferable.