Linked Questions

36 votes
4 answers

Can ECDSA signatures be safely made "deterministic"?

Using the terminology of the ECDSA Wikipedia page, ECDSA (and DSA) signatures require a random k value for each signature which ensures that the signature is different each time even if the message ...
ByteCoin's user avatar
  • 737
5 votes
1 answer

Exactly what RNG weaknesses endanger (EC)DSA?

RFC 6979 defines deterministic variants of (EC)DSA. It states in introduction One characteristic of DSA and ECDSA is that they need to produce, for each signature generation, a fresh random value (...
fgrieu's user avatar
  • 142k
3 votes
2 answers

Can I get away with generating 512-bit k (and d) for ECDSA based on P-521?

I've been implementing a hobbyist cryptography library, and I'm at the part where elliptic-curve cryptography is being implemented. I've already implemented and tested ECDSA with P-256 and P-384, ...
DannyNiu's user avatar
  • 9,421
3 votes
2 answers

How robust is RSA-FDH against distribution bias?

Suppose we want to use the RSA-Full Domain Hash (-FDH) signature scheme. This essentially works precisely like textbook RSA but instead of signing $m$ directly, we sign $H(m)$ with $H:\{0,1\}^*\to\...
SEJPM's user avatar
  • 46.1k
2 votes
1 answer

Can private key be specified on key pair creation?

Without regards to any specific implementation of asymmetric cryptography, I am wondering if it is feasible to come up with a value of private key I want to use, and calculate the corresponding public ...
Greendrake's user avatar
2 votes
1 answer

Is it possible to brute-force the nonce used in ECDSA?

It is a well-known fact that knowing the nonce used in signing the ECDSA signature allows the private key to be computed easily from that signature. If I understand it correctly, this nonce is a ...
Mr. Engineer's user avatar
2 votes
0 answers

Short Nonces in ECDSA signature generation

Recently I noticed that my device generates short-sized Nonces. Approximately $2 ^ {243} - 2^{244}$. Could it turn out that there will be a small leak of ...
Derick Swodnick's user avatar
1 vote
2 answers

Recovering nonce in ECDSA with known shared components in ECDSA

This is a slight variation of the shared nonce problem. We do have a lot more shared information between two nonces. Given a random $k$: $$ k_1 = ka, k_2 = kb $$ I am now signing two messages, which ...
kazamatzuri's user avatar
1 vote
1 answer

How should one handle the identity value and other "obviously" weak secret random values?

In RSA, ECDSA, ElGamal and quite a few other schemes, using a secret (random) value equal to 1 might not provide any form of security, while still being mathematically sound. For RSA, ECDSA or ElGamal,...
Lery's user avatar
  • 7,709
1 vote
1 answer

DSA - can $k$ be 1?

I'm learning DSA and I'm wondering if $k$ can be 1. I know that k has to be from $\mathbb{Z}_{q-1}$ but I don't know whether 1 is allowed (not talking about security concerns, purely educational). I ...
Mallard's user avatar
  • 11
1 vote
0 answers

Is it possible to recover the private key if the same message is signed twice with different nonce? [duplicate]

Sorry if this question is misguided, I'm a software developer and not a cryptographer. Let's say I have a public key, and 2 signed messages. Signed message 1: ...
Ilia Sidorenko's user avatar
0 votes
1 answer

Help breaking ECDSA with biased nonces

I am currently trying to do the cryptopals challenge 62, breaking ECDSA with biased nonces, with the help of those two links (1 2) that describe accurately the attack. However, after around 15 hours, ...
Katoptriss's user avatar
0 votes
0 answers

Can private key used in ECDSA be discovered when many signatures were colleced? [duplicate]

Can private key used in ECDSA be discovered when many signatures of different messages were collected (1M+) or may signatures of the same message were collected? Will small nonce bias be easily ...
Alexander Weps's user avatar
0 votes
0 answers

Can knowing the ephemeral key recover the private key in ECDSA

If the attacker - some guy who really, really wants to steal bitcoins - somehow finds the ephemeral key used in an 256-bit ECDSA signature, can he recover the private key? If so, would knowing the ...
Biology nerd's user avatar
0 votes
0 answers

In DSA digital signature, why does k have to be random and unique each for each signing? [duplicate]

If we repeat k, I think there is little chance for s to repeat since user's private key x is ...
cscisgqr's user avatar
0 votes
0 answers

Choosing K in ECDSA SECP256K1

I am working on a very resource-constrained environment. Using a standard peer reviewed library isn't possible because it won't fit within the RAM requirements of the device (~5K unused ram without ...
NateBrune's user avatar
-2 votes
1 answer

Calculating $K,N,X$ in ECDSA?

I'm confused with the parameter $n$, whether the parameter $n$ is the support point FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F or what? ...
Mas Ndoloxz's user avatar