Linked Questions

0
votes
0answers
49 views

In DSA digital signature, why does k have to be random and unique each for each signing? [duplicate]

If we repeat k, I think there is little chance for s to repeat since user's private key x is ...
26
votes
3answers
8k views

Can ECDSA signatures be safely made “deterministic”?

Using the terminology of the ECDSA Wikipedia page, ECDSA (and DSA) signatures require a random k value for each signature which ensures that the signature is different each time even if the message ...
5
votes
1answer
364 views

Exactly what RNG weaknesses endanger (EC)DSA?

RFC 6979 defines deterministic variants of (EC)DSA. It states in introduction One characteristic of DSA and ECDSA is that they need to produce, for each signature generation, a fresh random ...
3
votes
2answers
378 views

How robust is RSA-FDH against distribution bias?

Suppose we want to use the RSA-Full Domain Hash (-FDH) signature scheme. This essentially works precisely like textbook RSA but instead of signing $m$ directly, we sign $H(m)$ with $H:\{0,1\}^*\to\...
-2
votes
1answer
209 views

Calculating $K,N,X$ in ECDSA?

I'm confused with the parameter $n$, whether the parameter $n$ is the support point FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F or what? ...
2
votes
1answer
85 views

Can private key be specified on key pair creation?

Without regards to any specific implementation of asymmetric cryptography, I am wondering if it is feasible to come up with a value of private key I want to use, and calculate the corresponding public ...
0
votes
0answers
168 views

Choosing K in ECDSA SECP256K1

I am working on a very resource-constrained environment. Using a standard peer reviewed library isn't possible because it won't fit within the RAM requirements of the device (~5K unused ram without ...
1
vote
1answer
87 views

DSA - can $k$ be 1?

I'm learning DSA and I'm wondering if $k$ can be 1. I know that k has to be from $\mathbb{Z}_{q-1}$ but I don't know whether 1 is allowed (not talking about security concerns, purely educational). I ...
1
vote
1answer
65 views

How should one handle the identity value and other “obviously” weak secret random values?

In RSA, ECDSA, ElGamal and quite a few other schemes, using a secret (random) value equal to 1 might not provide any form of security, while still being mathematically sound. For RSA, ECDSA or ...
0
votes
0answers
70 views

Can knowing the ephemeral key recover the private key in ECDSA

If the attacker - some guy who really, really wants to steal bitcoins - somehow finds the ephemeral key used in an 256-bit ECDSA signature, can he recover the private key? If so, would knowing the ...