Questions tagged [dsa]
The Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. It was proposed by the National Institute of Standards and Technology (NIST) in August 1991 for use in their Digital Signature Standard (DSS), specified in FIPS 186, adopted in 1993. A minor revision was issued in 1996 as FIPS 186-1. The standard was expanded further in 2000 as FIPS 186-2 and again in 2009 as FIPS 186-3.
517
questions
3
votes
0
answers
93
views
EC public key with leading zeros
Let us take example of secp256k1 curve. The current known public key with most leading zero (in x cordinate) is:
...
- 31
3
votes
1
answer
1k
views
Why do we need additional secret value (k) in ECDSA?
Formula for calculating an ECDSA signature (r, s) is:
s = k-1(z + qr)
k - private key for a random point R
z - hash of a message
q - original private key
r - x(R)
I am interested in why do we need ...
- 133
5
votes
2
answers
1k
views
Are curve secp256k1 ECDSA signatures distinguishable from random data?
Are the 64-byte curve secp256k1 ECDSA signatures distinguishable from random data?
I.e. Given a random private key and random data, will there be patterns?
Is there a proof or reasoning for this?
- 897
1
vote
0
answers
24
views
Where do we put known bits of nonce when performing lattice attack on ECDSA?
I have read so many papers and posts about lattice attacks on ECDSA but none of them used an example of different MSB values for k but instead they all used fixed MSB.
So here i am trying to ...
0
votes
0
answers
29
views
Three ECDSA signatures sharing first component r, verifying against same message and public key?
For some common curve, can we exhibit three distinct ECDSA signatures $(r,s_1)$, $(r,s_2)$, $(r,s_3)$, a message $m$, and valid public key $Q$, such that the signatures verify?
Can we also generate ...
- 138k
1
vote
2
answers
109
views
Can ECDSA be broken if same nonce is used with the same message?
I have a scenario where $k_2 = -k_1$ while $z_1$ and $z_2$ are identical but the values $s_1$ and $s_2$ are different.
So we have $r_1 = r_2$ and $z_1 = z_2$ but $s_1 \neq s_2$.
Does this mean an ...
3
votes
1
answer
91
views
Differences between the theory and implementation of a lattice attack against ECDSA
I know the theory of lattice attacks against ECDSA from Minerva. So, as far as I can understand, the lattice that they build is
$$
L_M = \begin{bmatrix}
2^ln & 0 & 0 & \cdots & 0 & ...
- 31
0
votes
0
answers
42
views
Is this ECDSA's protection mechanism or something wrong with it?
Over the past few months, I have been reading and trying to understand how ECDSA works and how safe is it.
So now something does not add up between its signature verification and generation.
But maybe ...
0
votes
0
answers
51
views
Framework for manipulating digital signatures
for a research project, i am currently looking for a way to manipulate the digital signature of a HTTPS TLS message flow. More specifically, i am trying to create a working example for a malicious ...
1
vote
0
answers
51
views
Can lattice attack work MSB or LSB are unkown but 16 bytes of private key are known?
I have been reading about lattice attack on ECDSA when partial bits of nonce are known for amount of signatures, So i went through some source code trying to understand how it works.
First of all, ...
0
votes
0
answers
56
views
Same message different nonce but similarities in r value of the signatures(r,s)
I'm studying a case where when i sign a same message with the same private key and a different nonce, i sometimes get signatures (r,s) where r values share some similarities (same numbers at the same ...
- 101
0
votes
0
answers
43
views
Practical deployments of ECC with cofactor of elliptic curves $4$ or $8$?
Are cofactor $4$ and $8$ ECC schemes widely used in practical deployments such as those in cryptocurrencies?
Can you name some practical settings where there curves are used and cryptocurrencies where ...
- 908
2
votes
1
answer
258
views
Does RFC 6979 unconditionally prevent nonce-reuse attacks?
Is RFC 6979 guaranteed to prevent the reuse of nonces for different signed hashes?
- 3,635
1
vote
2
answers
46
views
In ECDSA over K256, Why R.x should be less than the subgroup order, not field order? But in BIP340 over K256, should be less than field order
I understand that R.x is a field element.
I don't understand why in ECDSA verification ie. FIPS 186-5 section 6.4.2 step 1, we check whether r is less than subgroup order.
If it has something to do ...
- 143
2
votes
1
answer
54
views
Why are there two Challenges in the DSA Identification Scheme?
Would either $\alpha$ or $r$ suffice as challenge?
I am aware that the signature and verification were to adapt. However, what is the motivation behind using two challenges?
- 21
0
votes
1
answer
59
views
Reason for two random numbers in DSA?
Why is the signature in DSA the way it is?
I am referring to $r$ and $k$ in the Signing-Algorithm depicted below. Is it really necessary to have both, $r$ and $s$, or would it still be secure if only ...
- 21
0
votes
1
answer
41
views
Using plaintext + ciphertext combination as substitute for authentication/signature in elliptic curve cryptography
I'm working on a system where I need to sign some data using an ECC private key and share the data and signature over a BLE ADV packet. Since an ADV packet is limited in space, I can't use a full ...
1
vote
0
answers
21
views
In DSA, can we tell if signatures are for the same key pair?
We are given some distinct DSA signatures $(r_i,s_i)$ and the distinct hashes $H_i$ of the corresponding messages. The signatures and messages are non-maliciously made per the same known group ...
- 138k
2
votes
2
answers
191
views
Can we recover public key from DSA signatures as we can from ECDSA?
I learned the Public Key Recovery algorithm for ECDSA, and wonder if we can use it in DSA. The answer seems to be no, but details are welcome.
- 23
0
votes
1
answer
75
views
Understanding the Communication Protocol of Apple HomeKey
I am currently analyzing the communication protocol of HomeKey. Here are two traces between the lock (reader) and the device (card).
First set:
...
- 101
3
votes
1
answer
596
views
When using ECDSA P-384 for signing and verifying messages, should the public key be also included **INSIDE** the message before signing?
I am using ECDSA P-384 for signing and verifying messages. The messages are basically stringified JSON. After receiving, the recipient verifies the signature using the public key.
Should the public ...
2
votes
1
answer
621
views
ECDSA simpler formula?
In ECDSA, if Alice wants to send a message to Bob, she computes $s=k^{-1}(z+rd_A)$.
I was thinking that the formula could simply be $s=k^{-1}zrd_A$ and the algorithm would work just as well, and the ...
- 23
0
votes
0
answers
78
views
Apple secure enclave with RFC6979
Does Apple secure enclave support rfc6979 with P256 curve? This RFC defines a deterministic ecdsa with a deterministic k value.
THATS LINK OF THE RFC https://www.rfc-editor.org/rfc/rfc6979
I looked ...
4
votes
1
answer
126
views
ECDSA (ecrecover) - How an attacker can construct a hash and signature that look valid
I found information, that it is possible to construct a hash and signature that look valid if the hash is not computed within the contract itself (we are talking about ECDSA/ecrecover here).
So, the ...
- 143
1
vote
0
answers
192
views
JavaScript SubtleCrypto - Is there a way to convert the ECDSA keys into a more "portable" format and preferably shorter? [closed]
I asked this question on StackOverflow but it seems like it's more appropriate for this Crypto community.
I am using the browser built in SubtleCrypto library in javascript to generate public and ...
6
votes
1
answer
143
views
What's the current status of development of hedged ECDSA and EdDSA?
In the IETF Draft Deterministic ECDSA and EdDSA Signatures with Additional Randomness, methods had been specified to seed RNG deterministically with external input, to securely obtain a nonce for use ...
- 9,001
5
votes
1
answer
82
views
Securely derive multiple EC keys from master EC key and prove it
Alice has master EC key pair: $a$ - private key, $A$ - corresponding public key
Bob generates 2 random integers $r_1$ and $r_2$ and wants Alice to derive 2 new key pairs:
$a_1$ = $a$ + $r_1$ and $a_2$ ...
- 149
0
votes
0
answers
66
views
Why using linear increasing nonce in DSA in a bad idea?
Suppose we sign and verify messages with a DSA scheme. Before signing the first
message the necessary parameters $(p,q,h,g,x,y)$ are initialized, including the nonce $k$ as an integer between $(1,q-1)$...
- 1
2
votes
0
answers
21
views
Back2back addition with Jacobian Coordinate
I implemented below algorithm in hardware and it works fine with first point addition.
However, when I continue to perform back-to-back addition, I got the wrong result.
The part that I'm not sure ...
- 83
2
votes
0
answers
16
views
Which channel protocol should I use to broadcast the message between parties?
I am building the Threshold Signature Scheme (TSS) based wallet. I would like to run the each party's node separately with different host. And these nodes should be able to send the messages through ...
3
votes
0
answers
109
views
Prove DSA signature scheme is EUF-CMA secure
I want to prove that the DSA signature scheme is EUF-CMA secure in the random oracle model, if the discrete logarithm problem is hard. I know it can be proved by the following two parts:
Discrete ...
- 31
0
votes
1
answer
75
views
Multiplicative Inverse in Point Addition/Point Multiplication
Walkthrough the textbook content, understand that we need to compute the slope of 2 points before can compute the new point as the result of addition.
Multiplicative inverse is part of the operation ...
- 83
1
vote
1
answer
37
views
How to authenticate multiple IOT devices having unique certificates (ECDSA)?
I'm relatively new to the field of security.
I'm working on an IoT system with WiFi-connected nodes (Bio-sensing devices) communicating with a server for centralized monitoring.
I need to authenticate ...
- 13
1
vote
1
answer
105
views
Recovering the curve-point R from a signature ECDSA
When recovering the public key from ECDSA signature (r, s), the first step is recovering the point R.
You do this by plugging in (r + xn) into the curve equation where n is the order of the basepoint ...
- 11
2
votes
1
answer
305
views
Why must ECDSA verification ensure the point is on the curve?
In ECDSA, when parsing the public key a test is made to ensure the public key really lies on the curve. What vulnerabilities appear if one does not do this?
- 73
2
votes
0
answers
154
views
Forging an ECDSA signature for a random public key string
An adversary is able to insert a random string (which he does not control: he can only randomly generate it and insert it). The random string is parsed by the victim as an ECDSA public key. This ...
- 73
2
votes
1
answer
163
views
What degree of k bias is acceptable in ECDSA?
So there’s LadderLeak.
RFC6979 produces uniformly random nonce $k$.
There are other techniques, such as hash-to-curve standard (draft-irtf-cfrg-hash-to-curve-16 section 5), which allows to produce ...
- 340
0
votes
0
answers
22
views
Digital Signature Algorithm(DSA) without hashing the message? [duplicate]
I am learning about various digital signatures and came across DSA. In DSA, the $s$ part of the signature has a hash of the message $H(m)$. I was wondering, why can't we just use the message $m$ ...
1
vote
1
answer
513
views
ECDSA SECP256k1 curve - same-r-value-is-used-for-two-different-addresses
Edited: changing the notation according request by fgrieu.
I have prepared 4 transactions for 2 pubkeys with the same r1 and r2.
properties of secp256k1:
...
- 11
2
votes
1
answer
271
views
ECDSA-SHA256 HTTP Signature String Construction
I must verify an HTTP signature to guarantee the origin and integrity of a webhook data: https://www.blockcypher.com/dev/bitcoin/#webhook-signing
This is their x509 PKIX encoded signing key's public ...
- 33
1
vote
0
answers
45
views
Verifying ECDSA-SHA256 HTTP Signature [duplicate]
With PHP, I'm trying to setup a HTTP signature verification for webhook requests coming from BlockCypher: https://www.blockcypher.com/dev/bitcoin/?php#webhook-signing
This is their public key: ...
- 33
1
vote
1
answer
46
views
Can a quantum attacker prove that incomplete ECDSA signatures were produced with the same key?
Assume a 256-bit ECDSA private key used with Secp256k1 and SHA-256. This key signs multiple different messages in a fully deterministic manner as described in RFC-6979, so signing the same message ...
- 43
3
votes
2
answers
137
views
Given multiple incomplete ECDSA signatures, what can a quantum attacker learn in the following scenarios?
Assume a 256-bit ECDSA private key used with Secp256k1 and SHA-256. This key signs multiple different messages in a fully deterministic manner as described in RFC-6979, so signing the same message ...
- 43
2
votes
0
answers
36
views
Fusion auth versus jose4j library for jwt using secp256k [closed]
I am a beginner in-terms of JWT libraries in programming.
How the keypair used (secp256k1) is related with the algorithmic header used for creation of JWT?
And why authfusion doesn't need an ...
- 21
3
votes
3
answers
1k
views
How can we reverse Elliptic Curves after solving the DLP problem?
Suppose that I've solved the Discrete Logarithm problem. Can someone explain to me in terms of the example below how to arrange values of Elliptic Curve secp256k1 in a reverse form so that I can ...
0
votes
1
answer
170
views
Solve discrete logarithm with new chinese research
Does this research also work for breaking bitcoin ECDSA? If so, how many qubit will be needed for 256-bit elliptic curve key?
user106244
2
votes
0
answers
99
views
Could classical computers end up breaking the ECDLP through prime factorization (GNFS)?
Is there any way in which classical computers oculd end up breaking ECDLP. I read that GNFS could through prime factorization, but I am not sure if I understood this properly.
- 61
4
votes
2
answers
633
views
How could ECDSA be broken with prime factorization through Shor's Algorithm?
could anyone help me understand how is ECDSA broken using Shor's Algorithm? All the papers I find are too complex to understand, and even though I feel I understand some concepts, some others are a ...
- 61
1
vote
0
answers
45
views
ECDSA security proof in random oracle [duplicate]
I need to know if there is a security proof for ECDSA in the Random Oracle model?
- 51
1
vote
2
answers
538
views
Convert a Schnorr Public Key to a compressed ECDSA Public Key
Given a Schnorr Public Key (32 bytes) x, I'd like to generate a compressed ECDSA Public Key (33 bytes) and thus be able to generate the bitcoin address that the private key holder can generate with ...
- 29