Linked Questions

3 votes
2 answers
616 views

How robust is RSA-FDH against distribution bias?

Suppose we want to use the RSA-Full Domain Hash (-FDH) signature scheme. This essentially works precisely like textbook RSA but instead of signing $m$ directly, we sign $H(m)$ with $H:\{0,1\}^*\to\...
SEJPM's user avatar
  • 46.1k
1 vote
2 answers
2k views

Recovering nonce in ECDSA with known shared components in ECDSA

This is a slight variation of the shared nonce problem. We do have a lot more shared information between two nonces. Given a random $k$: $$ k_1 = ka, k_2 = kb $$ I am now signing two messages, which ...
kazamatzuri's user avatar
5 votes
1 answer
928 views

Exactly what RNG weaknesses endanger (EC)DSA?

RFC 6979 defines deterministic variants of (EC)DSA. It states in introduction One characteristic of DSA and ECDSA is that they need to produce, for each signature generation, a fresh random value (...
fgrieu's user avatar
  • 142k
2 votes
1 answer
840 views

Is it possible to brute-force the nonce used in ECDSA?

It is a well-known fact that knowing the nonce used in signing the ECDSA signature allows the private key to be computed easily from that signature. If I understand it correctly, this nonce is a ...
Mr. Engineer's user avatar
2 votes
1 answer
109 views

Can private key be specified on key pair creation?

Without regards to any specific implementation of asymmetric cryptography, I am wondering if it is feasible to come up with a value of private key I want to use, and calculate the corresponding public ...
Greendrake's user avatar
1 vote
1 answer
85 views

How should one handle the identity value and other "obviously" weak secret random values?

In RSA, ECDSA, ElGamal and quite a few other schemes, using a secret (random) value equal to 1 might not provide any form of security, while still being mathematically sound. For RSA, ECDSA or ElGamal,...
Lery's user avatar
  • 7,709
1 vote
1 answer
265 views

DSA - can $k$ be 1?

I'm learning DSA and I'm wondering if $k$ can be 1. I know that k has to be from $\mathbb{Z}_{q-1}$ but I don't know whether 1 is allowed (not talking about security concerns, purely educational). I ...
Mallard's user avatar
  • 11
0 votes
1 answer
1k views

Help breaking ECDSA with biased nonces

I am currently trying to do the cryptopals challenge 62, breaking ECDSA with biased nonces, with the help of those two links (1 2) that describe accurately the attack. However, after around 15 hours, ...
Katoptriss's user avatar
-2 votes
1 answer
470 views

Calculating $K,N,X$ in ECDSA?

I'm confused with the parameter $n$, whether the parameter $n$ is the support point FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F or what? ...
Mas Ndoloxz's user avatar
2 votes
0 answers
536 views

Short Nonces in ECDSA signature generation

Recently I noticed that my device generates short-sized Nonces. Approximately $2 ^ {243} - 2^{244}$. Could it turn out that there will be a small leak of ...
Derick Swodnick's user avatar
1 vote
0 answers
49 views

Is it possible to recover the private key if the same message is signed twice with different nonce? [duplicate]

Sorry if this question is misguided, I'm a software developer and not a cryptographer. Let's say I have a public key, and 2 signed messages. Signed message 1: ...
Ilia Sidorenko's user avatar
0 votes
0 answers
97 views

Can private key used in ECDSA be discovered when many signatures were colleced? [duplicate]

Can private key used in ECDSA be discovered when many signatures of different messages were collected (1M+) or may signatures of the same message were collected? Will small nonce bias be easily ...
Alexander Weps's user avatar
0 votes
0 answers
459 views

Can knowing the ephemeral key recover the private key in ECDSA

If the attacker - some guy who really, really wants to steal bitcoins - somehow finds the ephemeral key used in an 256-bit ECDSA signature, can he recover the private key? If so, would knowing the ...
Biology nerd's user avatar
0 votes
0 answers
142 views

In DSA digital signature, why does k have to be random and unique each for each signing? [duplicate]

If we repeat k, I think there is little chance for s to repeat since user's private key x is ...
cscisgqr's user avatar
0 votes
0 answers
359 views

Choosing K in ECDSA SECP256K1

I am working on a very resource-constrained environment. Using a standard peer reviewed library isn't possible because it won't fit within the RAM requirements of the device (~5K unused ram without ...
NateBrune's user avatar

15 30 50 per page