We are given some distinct DSA signatures $(r_i,s_i)$ and the distinct hashes $H_i$ of the corresponding messages. The signatures and messages are non-maliciously made per the same known group parameters $(p,q,g)$ (say the 2048-bit MODP group with 256-bit prime order subgroup of RFC 5114), using either one of two distinct non-maliciously drawn public/private key pairs. We do not know these public keys, much less these private keys.

Can we tell whether two signatures pertain to the same public key?

Inspired by this question.



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.