Questions tagged [dsa]

The Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. It was proposed by the National Institute of Standards and Technology (NIST) in August 1991 for use in their Digital Signature Standard (DSS), specified in FIPS 186, adopted in 1993. A minor revision was issued in 1996 as FIPS 186-1. The standard was expanded further in 2000 as FIPS 186-2 and again in 2009 as FIPS 186-3.

Filter by
Sorted by
Tagged with
0
votes
0answers
64 views

An “unsafe” curve over RSA? [duplicate]

I'm implementing a token server and considering backing them with ECDSA. The options from the library I'm using expose the NIST curves P-256, P-384, and P-521. The safe curves site does not list P-521,...
1
vote
0answers
42 views

Security of an ECDSA Adaptor Signature Implementation

I'm currently working on an implementation of ECDSA Adaptor Signatures, and part of the signature scheme calls for a NIZK proof to verify knowledge of exponent over two public keys that share a ...
2
votes
2answers
107 views

Is it OK to use r-value from ECDSA signature (r, s) to prevent replay attack?

ECDSA signatures are malleable. Given a valid signature (r, s), one can create a second valid signature by negating the s value. I have searched workaround for this issue, and https://yondon.blog/2019/...
5
votes
1answer
483 views

What is the Lord of the Ring(s): Side Channel Attack and What are the results

A recent Paper to appear on USENIX Security 2021 titled as Lord of the Ring(s): Side Channel Attacks on the CPU On-Chip Ring Interconnect Are Practical by Riccardo Paccagnella Licheng Luo Christopher ...
0
votes
1answer
136 views

How to compare the time of encryption, cracking and verification elliptic curve problem in the same framework?

everyone! As a beginner, I would like to ask you a question. The best algorithm known for cracking (done by anonymous snooper) this problem (Discrete logarithm problem of elliptic curve or ECDSA)is ...
0
votes
1answer
47 views

Elliptic curve in Binary Field implementation

For Elliptic curves defined over $GF(2^n)$, by adding any two points P and Q over $GF(2^n)$ we get the third point over $GF(2^n)$. In Elliptic Curve Digital Signature Algorithm (ECDSA) https://en....
1
vote
1answer
112 views

How did this group discover m wasn't random?

In this video a group of "hackers" describe how they discovered private keys for the PS3 that was using this ECDSA algorithm by discovering that the "random" integer $m$ (or $k$ in ...
0
votes
0answers
44 views

Guarding against vulnerabilities for a digital signature service (RSA )

Lets's say I have a cipher-module / cryptography-service that signs a hash of some unknown payload. What are the possible attacks that I would need to guard against in this context (primarily assuming ...
1
vote
1answer
32 views

ecdsa nonce reuse to compute the private key, modular inverse question

I am following along some cryptography challenges:, in particular ECDSA Nonce Reuse here (second problem): https://blog.coinbase.com/capture-the-coin-cryptography-category-solutions-fe94d82165c5 I ...
1
vote
1answer
71 views

Security level of DSA when $q$ is a 224 bit prime?

What is the security level of DSA algorithm when $q$ is a 224 bit prime? Is it always a simple rule that the security level is the bit length of $q$ divided by two ?
1
vote
0answers
124 views

Calculating ECDSA Private Key From Multiple Signatures With Shared k (random nonce)

I've been experimenting with ECDSA signatures and with how the Sony PS3 private key was leaked. Specifically where: $$k = \frac{z_1 - z_2}{s_1 - s_2}$$ $$d_A = \frac{z_1s_2 - z_2s_1}{k(s_1 - s_2)}$$ ...
3
votes
0answers
82 views

How can the Number Field Sieve attack the discrete log in $\mathbb Z_p^*$ of DSA?

The Digital Signature Algorithm (DSA) uses $L$-bit prime $p$ and $N$-bit prime $q$ with $q| p-1$, i.e., $p = r\cdot q +1$ ( Schnorr group if $r>2$ and safe prime if $r=2$). In a way, the security ...
1
vote
1answer
12 views

DSA parameter selection

In the Digital Signature Algorithm, is there a reason why the larger prime parameter should be an $N$-bit prime where $N$ is a multiple of 64 ? Is this strictly necessary for proper working of the ...
1
vote
0answers
51 views

ECDSA sign test vectors

I've seen a large set of ECDSA test vectors for verification. In addition, I've seen some test vectors from NIST, and those can be found here. Is anyone aware of ECDSA sign test vectors which, if &...
1
vote
0answers
33 views

Understanding multiplication of Shamir secret sharing during threshold (EC)DSA signing

I have been looking at the threshold (EC)DSA schemes for honest majority by Gennaro et al. https://www.sciencedirect.com/science/article/pii/S0890540100928815. In the scheme, there are steps where we ...
1
vote
1answer
67 views

Can ECDSA signature signing and verification process replaces password hashed based login system?

ECDSA or DSA in general was to sign a message or data using private key and verify it using public key, if the attacker/imposter doesn't have the private key then they couldn't sign the message ...
0
votes
1answer
91 views

Does it make any sense to hash parts of a hashing target?

TL;DR; Assuming I'm calculating SHA256 for an ECDSA, does it make sense to do SHA256(item1 + SHA256(item1') + item2 + SHA256(item2') + itemN + SHA256(itemN')) or it'...
0
votes
1answer
65 views

Calculating ECDSA m or k (k or d) when s1 = s2

I recently began to look into some information about obtaining the private key $k$ when two signatures have been produced using the same $m$ and $k$. I've been using the well-publicised information ...
0
votes
1answer
90 views

Calculating the point on the curve during ECDSA signature verification

I'm confused as to how he got (62, 44) as an answer within this article: https://www.coindesk.com/math-behind-bitcoin
0
votes
1answer
79 views

ECDH/ECDSA key exchange on embedded devices

Two devices are communicating only with each other and shall do this with AES encryption. Both devices are offline, have very limited storage and use a small cryptographic coprocessor which is able to ...
2
votes
1answer
93 views

Problem with the signature of message using ECDSA over GF(2^m)

I'm trying to set up an ECDSA with Elliptic Curves over $\operatorname{GF}(2^m)$ with an example of toy with the following values: Using the Weierstrass equation on binary finite fields. $$E: y^2 + x*...
0
votes
0answers
29 views

Which signature is considered more secure and has less communication cost?

This article uses Elliptic Curve Cryptography, but when it comes to signing and verifying messages it is not using the ECDSA signature algorithm. In the article, they mentioned that the communication ...
0
votes
0answers
44 views

Is this a good implementation of digital signature with timestamp?

Is this a good practice ?. How good or bad is this compared to appending a timestamp to the actual data and hashing it as represented below. ...
0
votes
0answers
50 views

Can private key used in ECDSA be discovered when many signatures were colleced? [duplicate]

Can private key used in ECDSA be discovered when many signatures of different messages were collected (1M+) or may signatures of the same message were collected? Will small nonce bias be easily ...
0
votes
0answers
44 views

Vulnerability in the Digital Signature Algorithm. Can I calculate k and x?

I feel DSA is vulnerable if k is randomly selected over a small set, example, {1,2,...,2^16 -1}. I am trying to come up with a program where I assume I have the public parameters (p,q,g) , public key :...
0
votes
2answers
95 views

The Generator point and Mod P in ECDSA

I've been reading about The discrete logarithm problem as of recent and i decided to try it out on a small portion of numbers myself and i actually came to a mental gridlock after watching this Video....
2
votes
1answer
126 views

How is EdDSA different from ECDSA with a custom curve?

I just found this draft/informal IETF specification: Alternative Elliptic Curve Representation: This document specifies how to represent Montgomery curves and (twisted) Edwards curves as curves in ...
1
vote
2answers
69 views

Can the ECDSA still work without present of hashing function? [duplicate]

According to walkthrough steps for ECDSA topic from wikipedia as shown below, What if the impact if we don't apply the hashing function (highlighted in blue in the image) to the raw messages? Although ...
1
vote
2answers
71 views

Using different hashing function with ECDSA

I came across an IC device configuration & security flow and the details are illustrated in image below. I'm wondering must the ECDSA pair with the SHA Hashing function? Alternatively, what if ...
1
vote
1answer
63 views

What is the use of pre-computed points in ECC?

I am trying to understand the use of pre-computed points in ECC for ECC signature, verification, key generation, and so on. After searching on the internet, I understand that pre-computed points aid ...
0
votes
1answer
73 views

TLS 1.2 Server Key Exchange problem

Below the Wireshark snapshot of the handshake compliant to the TLS 1.2. The position 1 displays the enum ServerECDHParams where I can use any curve having the own ID RFC8422. I'm free for example to ...
0
votes
0answers
50 views

how to efficiently compute private key in DSA with known parameters

For textbook DSA, as defined below. If $r, s, k, g, p, q, m$ are all known, is it possible to efficiently compute $x$ from all these given values? How does the math work out? Secret key: $x\stackrel ...
2
votes
2answers
134 views

ECDSA signature generation and verification latency

I am performing some measurements of P256 ecdsa signature generation and verification latency and I was expecting that the signature verification will be faster than the signature generation, but is ...
3
votes
0answers
76 views

Constant time arithmetic implementation in DSA

I am trying to understand why it is a hard problem to have formally verified constant time arithmetic for DSA when compared with ECDSA. For instance, in ECDSA implementations of OpenSSL, we have ...
0
votes
0answers
70 views

Cryptanalytic tests for biased nonces

In the paper Biased Nonce Sense: Lattice Attacks against Weak ECDSA Signatures in Cryptocurrencies on section 5.2 Cryptanalytic tests for biased nonces, one of test is: Select two signatures at ...
4
votes
1answer
108 views

ECDSA: with knowledge of private key, can we make signatures with partially chosen content?

In ECDSA, with knowledge of private key, can we make signatures with partially chosen content? Detailing that: In ECDSA (with secp256r1 curve and SHA-256 hash), assume we know the private key, the ...
3
votes
2answers
1k views

Difference between X25519 vs. Ed25519

I am reading https://en.wikipedia.org/wiki/Curve25519 and it states Also in 2018, RFC 8446 was published as the new Transport Layer Security v1.3 standard. It requires mandatory support for X25519, ...
1
vote
1answer
83 views

Can you use ECDSA on pairing-friendly curves?

I'm learning about Elliptic curve cryptography. If I understand right, ECDSA and other algorithms used in ECC are dependent on the curve chosen. So, before you want to use ECDSA, you first have to ...
1
vote
1answer
106 views

Is it possible to safely implement the Signal Protocol (X3DH) without using XEdDSA

In the X3DH specification of the Signal Protocol it mentions having a signed pre-key in the key bundle. This pre-key is signed using the identity private-key. Because the identity private-key is in ...
1
vote
1answer
260 views

How Does Prime Factorization Break ECDSA?

I have heard that ECDSA will be broken in the not-to-distant future (roughly 15-25 years) by Quantum Computers running Shor's Algorithm. However, to my understanding, the only purpose of Shor's ...
2
votes
0answers
53 views

Security problems if ECDH and ECDSA use the same key [duplicate]

Hy! I want to use an EC key for ECDH and ECDSA too. Using the same key does compromise the security of the key in a cryptographic / mathematical sense? I read a lot in this theme, but I found nothing ...
1
vote
0answers
62 views

Difference and relation between ed25519, x25519 and XEd25519 [duplicate]

In my Rust implementation of a messaging system, I'm using currently two cryptographic primitives: ed25519_dalek and x25519_dalek. I use ed25519_dalek for DSA, while x25519_dalek for encryption of the ...
6
votes
1answer
275 views

What information is revealed if we send our points in Projective Coordinates?

Elliptic Curve Cryptosystem has various coordinate systems; like the Affine, Projective, and Jacobian coordinate systems. We prefer not to use the Affine coordinate system during the calculations ...
2
votes
1answer
88 views

Signature Generation Time vs Verification Time

When comparing the RSA-PSS signature algorithm with an elliptic curve based algorithm such as EdDSA, it is clear that signature verification takes less time for RSA than for EdDSA. For signature ...
0
votes
0answers
44 views

Bitcoin ECDSA signature

I am trying to use the ecdsaSign function in ecdsa.c of https://github.com/kvhnuke/Ethereum-Arduino/tree/master/Ethereum-Arduino/libs which is based on the files in the repo https://github.com/...
3
votes
1answer
263 views

What is the ChainOfFools/CurveBall Attack on ECDSA on Windows 10 CryptoAPI

What is the ChainOfFools/CurveBall Attack on ECDSA on Windows 10 CryptoAPI (Crypt32.dll) Could someone provide details?
2
votes
1answer
116 views

Is there any proof for ECDSA signature algorithm?

Related: Is there an interactive version of ECDSA signature protocol like the Schnorr identification protocol?
0
votes
0answers
67 views

Signing a secret key with ECDSA

Assume Alice and Bob both separately come into possession of the same randomly generated 256 bit secret key. Alice has Bob's public ECDSA key. Alice wants to verify that Bob has possession of the ...
3
votes
1answer
206 views

DSA: If signature is accepted then signature is correct

In one my classes, I have the following exercise: Prove that, in the DSA signature scheme, if a DSA signature is accepted, it is also correct. How would I go about proving this? In cryptography, ...
2
votes
1answer
93 views

ECDSA Private Key from SSS

I have all of the Shamir's secret shares required to Lagrange-interpolate f(0), which represents an ECDSA private key. The field of this object is ...

1
2 3 4 5
8