# Tag Info

4

First of all I do not know your implementation, but it seems that you have some basic misunderstandings. Signature: ECDSA(sha256(Data) ) ECDSA is typically implemented in a way that you do not explicitly hash the data prior to passing it to the signing algorithm (but as this might be your own implementation and signing may still work correctly). ...

3

Authentication can either mean entity authentication or data authentication. Data authentication is a means to demonstrate that some specific data originates from a specific source and has not been modified in transit/on storage. It can be achieved by the use of digital signatures in a public key, i.e., asymmetric, setting or message authentication codes ...

2

You have just to look at the signing/verification relation. Just write it as $$m\cdot s \equiv r\cdot \alpha + k \bmod (p-1)$$ And the verification relation should be $$g^{s\cdot m}\stackrel{?}{\equiv} y^r\cdot r \bmod p$$ where $y=g^\alpha$ is the public key and you eavesdrop a signature $(r,s)$ for $m$. Obseve that you can take any multiplicative ...

2

Yes. We can easily generate the malicious public key as in DSS case. The following attack was proposed in Section 4.5 of Blake-Wilson and Menezes: Unknown Key-Share Attacks on the Station-to-Station (STS) Protocol (PKC 1999). Let $(G,q,n,P)$ be the ECDSA parameters, where $n$ is the order of the group $G$ over the elliptic curve and $P$ is a generator of ...

2

Okay. So first up, let's eliminate encrypt-then-sign. Why is this a problem? The idea behind a signature is to prove that a message came from me even in the presence of malicious actors. If a malicious actor changes the ciphertext under the signature, clearly this invalidates the signature as per expectations, however, that is only one possible attack ...

2

Issues with the question first: Security is not something you can duct tape on to anything you want after the fact. You can never increase information entropy by processing data. It can be kept constant or decreased depending on whether you are doing a lossless or lossy tranformation. HASH("secret"+"public") is not necessarily secure for all crypto-hash ...

2

SpookyHash is clearly designated by its authors to be a non-cryptographic hash. In the cryptographic world there is simply no room for semi-broken at this level. Either there is some kind of margin to reach, say 128 bit security level or there isn't. This means that it should stand up to the current known attacks and that the design conveys enough piece of ...

2

The usual recommendation is ECDSA, or if you need a really short signature, BLS. See “Security.SE: What asymetric scheme provides the shortest signature, while being secure?”, “Security.SE: How to encrypt a short string to a short ciphertext using an asymmetric encryption?”, and “Crypto.SE: Short length asymmetric encryption?” for details. ECDSA should ...

2

I'll start with the last point and use the notation for ECDSA from the wikipedia article. Does it make any more difference if there is data that is known to have been signed by the private key and the signature(s) are known and the raw data is known? When using a digital signature scheme, the parameters (used group, e.g., elliptic curve group) as well ...

2

Use a zero-knowledge proof of knowledge (ZKPoK) of a value $(r,s)$ that is a valid signature. For instance, you might be able to adapt existing ZKPoKs for proof of knowledge of a discrete logarithm to this problem. Because it is zero-knowledge, you will know that it reveals nothing about $(r,s)$ and is not transferable.

1

Given a set of (unhashed) Lamport signatures using the same key, an attacker can trivially forge a signature for any message whose $k$-th bit, for each $k$, is equal to the $k$-th bit of at least one of the signed messages. For example, let's say I know the Lamport signatures for the following 16-bit messages using the same key:  m_1 = 0001111101110001 ...

Only top voted, non community-wiki answers of a minimum length are eligible