Questions tagged [dsa]

The Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. It was proposed by the National Institute of Standards and Technology (NIST) in August 1991 for use in their Digital Signature Standard (DSS), specified in FIPS 186, adopted in 1993. A minor revision was issued in 1996 as FIPS 186-1. The standard was expanded further in 2000 as FIPS 186-2 and again in 2009 as FIPS 186-3.

Filter by
Sorted by
Tagged with
0 votes
0 answers
49 views

ECDSA private key recovery

I have a bunch of signatures (1000) signed with ECDSA secp256k1 curve. I can verify all of them with the same public key. I have studied attacks are performed against ECDSA signatures using known MSB ...
user avatar
0 votes
0 answers
33 views

Consider the DSA digital signature scheme. Does the intercepted message m||s||r contain all information about the signer’s private key?

Consider the DSA digital signature scheme. Does the intercepted message m||s||r contain all information about the signer’s private key? Please justify your answer carefully. Please note that the ...
user avatar
  • 1
1 vote
0 answers
48 views

What data can be derived from ECDSA signature and message?

I generate a random message m sent to a device that calculates sig(m, privKey) with secp256k1...
user avatar
  • 11
3 votes
1 answer
111 views

Strauss-Shamir trick on EC multiplication by scalar

I'm studying ECDSA, and almost all somewhat detailed articles talk about using Strauss-Shamir trick on the verification step. Then I searched, and found this explanation (more like a stating) for the ...
user avatar
-1 votes
0 answers
36 views

PKI (public key infrastructure) based on digital certificates

Assume we are using a PKI (public key infrastructure) based on digital certificates (which is the norm and practice today). Therefore, we need public-key digital signature algorithms, standards and ...
user avatar
  • 13
3 votes
1 answer
302 views

Is it theoretically possible to delegate public key generation?

Imagine the following scenario: In a given cryptocurrency, privacy should be as high as possible. For this purpose, a new account with a new address is created for every incoming transaction (the ...
user avatar
2 votes
1 answer
115 views

Why is r used in ECDSA signature while R in Schnorr signature?

In Schnorr signature (R, s), R is used. But in ECDSA signature (r, s), r is used, which is the x-coordinate of R. Why the difference?
user avatar
2 votes
1 answer
317 views

Can I generate two similar ECDSA public keys?

I am using a system that relies on base64 encoded ECDSA public keys. I have managed to brute-force a public key that when encoded starts with a word I like. Is it possible for me, given the private ...
user avatar
  • 23
1 vote
1 answer
35 views

MAC vs MDC when using ECDH+ECDSA in OpenPGP

I intend to design a model to comply with RFC4880. According to RFC6637, ECC in OpenPGP +ECDSA to sign message +ECDH + KeyWrap for session key encryption -MAC: is used for key confirmation (with C(1e, ...
user avatar
  • 51
2 votes
1 answer
183 views

Is DSA still secure without the factor "r"?

If I understand correctly, the way DSA in a group $G$ with a hash function $H$ works is: Peggy (signer) has a private/public key pair $x$, $g^x$. For signing, she produces a random session key $k$, $g^...
user avatar
  • 23
1 vote
1 answer
86 views

Is f(G) uniform under the described condition in ECDSA?

In ECDSA, $f(G)=r$, where $r$ is the $𝑥$-coordinate of group element $G$. Now it is known that $f(G)$ is not uniform(Why isn't $f(G)$ uniform in ECDSA?). Then in which range $f(G)$ is uniform? Let $\...
user avatar
  • 707
1 vote
1 answer
113 views

Shor's algorithm and ECDSA in Bitcoin - why is finding the private key still difficult when we know the base point?

I'm learning about Shor's algorithm and how it can be applied to break ECDSA. I've clearly missed something basic here - I thought I understood that the challenge ECDSA presented was to find the ...
user avatar
  • 13
3 votes
2 answers
362 views

Can I get away with generating 512-bit k (and d) for ECDSA based on P-521?

I've been implementing a hobbyist cryptography library, and I'm at the part where elliptic-curve cryptography is being implemented. I've already implemented and tested ECDSA with P-256 and P-384, ...
user avatar
  • 6,541
0 votes
1 answer
31 views

Is it cryptographically secure to generate a ECDSA pair using username / password?

I'm thinking let's say you have a smart contract that ensures no double usernames. What's if I generate an ECDSA pair like so: Accept username and password Validate username and password Generate ...
user avatar
  • 103
2 votes
1 answer
170 views

Using same private key for both X25519 and ECDSA (using curve25519) [duplicate]

I'm writing an application where both encryption/decryption and signing/verification are needed, and I choose X25519 as a key agreement algorithm which will produce a key for encryption, and ECDSA to ...
user avatar
  • 23
2 votes
1 answer
125 views

Is it possible to brute-force the nonce used in ECDSA?

It is a well-known fact that knowing the nonce used in signing the ECDSA signature allows the private key to be computed easily from that signature. If I understand it correctly, this nonce is a ...
user avatar
0 votes
0 answers
97 views

What attacks exist on ECDSA if there are more than 10 million signatures?

I am aware that there are weaknesses in ECDSA when reusing NONCE and I am aware that there is a lattice attack on ECDSA. Are ...
user avatar
  • 3
1 vote
1 answer
44 views

Which application protocols use elliptic curve key recovery?

Section 4.1.6 of https://www.secg.org/sec1-v2.pdf describes a technique for recovering public keys from ECDSA signatures. I guess Ethereum uses this. Like if you want to validate a particular ...
user avatar
  • 2,703
0 votes
1 answer
78 views

Possible to directly calculate the Recovery ID from a msg, signature and public key in ECDSA/secp256k1?

Problem Let's say I receive a signature $(r,s)$, the corresponding public key and the message that was signed. I don't have access to the private key. I need to know what the ...
user avatar
0 votes
1 answer
113 views

Is it possible to generate ECDSA signature without nonce?

I am newbie to cryptography and my college has given me this ECDSA. I know that you have to divide result of: h(m)+r.priv in order to generate signature. But is it possible to generate signature ...
user avatar
  • 1
0 votes
0 answers
59 views

Avoid MITM Attack in ECDH Without HTTPS or a Third Party Certificate Authority

My context: I have a ECHD protocol, my main concern is MITM attack, it doesn't matters if you do HMAC or anything else in future to sign requests if your key exchange is compromised, Far from https ...
user avatar
2 votes
1 answer
198 views

Is the STARK Curve a SafeCurve?

SafeCurves defines criterias for choosing safe curves in elliptic-curve cryptography. STARK Curve defines a Stark-friendly elliptic curve that can be used with ECDSA. I was wondering: Is the STARK ...
user avatar
  • 407
2 votes
1 answer
157 views

Are the FIPS 186-5 and ANSI X9.142-2020 definitions of ECDSA consistent?

FIPS 186-4 Digital Signature Standard defers to ANSI X9.62-2005 for the specification of ECDSA, with additional requirements set out in Chapter 6 and Appendix D. However, X9.62-2005 has since been ...
user avatar
-1 votes
1 answer
26 views

Dsa generator verify problem

I'm trying to generate a signature for DSA with the following parameters: p=67 , q=11 , g=38 , H(m)=7 , x=6 (Is it correct to choose g=38?) I cannot choose a random k (0>k>q) that will give me r ...
user avatar
1 vote
0 answers
32 views

Finding an element of $\mathbb{Z}_p$ if the order of that element is known [duplicate]

I have two prime numbers $p$ (1024 bits) and $q$ (160 bits) such that $q$ divides $p-1$. Now I want to find an element $b$ in $\mathbb{Z}_p$ with the order of $q$. That means that $b^q \equiv 1 \mod p$...
user avatar
  • 11
1 vote
1 answer
78 views

Reusing additional data k' nonce from RFC6979 ECDSA

It is known that you must not reuse k in ECDSA; doing so will leak your private key. That's one of the reasons RFC6979 deterministic signatures were invented. Now, ...
user avatar
0 votes
0 answers
53 views

How to get public key and bitcoin compressed address from the coordinates (x,y) generated by ECDSA?

I have my x (0xca668a8b5f71e8724aada4b5343c28702a481787855cc42228b8fff97fe94d6a) and y (0x19dd3a603a55b3d8c5f62cbe177b9b63693fb8c91d76845bafc843a7aa19ea55) coordinates generated by ecdsa with a ...
user avatar
  • 1
0 votes
0 answers
13 views

How to sign CAM/DENM messages using mbed LTS libray with ECDSA (EEE Std 1609.2)

I have read ETSI TS 103 097 and EEE Std 1609.2 which gives me the security data structure defined in ASN.1 notation. I want to use mbed LTS to calculate the ECDSA signature. I understand that I should ...
user avatar
2 votes
0 answers
93 views

Short Nonces in ECDSA signature generation

Recently I noticed that my device generates short-sized Nonces. Approximately $2 ^ {243} - 2^{244}$. Could it turn out that there will be a small leak of ...
user avatar
0 votes
0 answers
40 views

Cryptography (DSA) Get Value of k and private Key

i am on a task in cryptography and need a hint (PLEASE NO SOLUTION). The Task is: I can send Messages (Digital Numbers) to a Docker Container. The response are the values p,q,g,z1,s,r and hashvalue(m+...
user avatar
1 vote
1 answer
198 views

Signing same message 2 times with ECDSA

Can multiple signatures of the same message with the same private key (different nonces) lead to a private key trace?
user avatar
0 votes
0 answers
42 views

Is it possible (and if so how) to make one proof for multiple private keys in ECDSA

Lets say I have a message that needs to be signed by two keys that were generated using ECDSA Is it possible to make a signature that accounts for both keys, meaning I can verify with both and see ...
user avatar
0 votes
1 answer
248 views

Can I know from a Bitcoin public key if the private key is odd or even?

Can I know just from a Bitcoin public key if the private key is odd or even? [moderator note] That is, can we find parity of the private key from a secp256k1 public key?For the original dump of ...
user avatar
0 votes
0 answers
45 views

Why does ECDSA produce a pair of values in its' signature (r,s)?

I was wondering why ecdsa generates a signature in form of a pair (r and s) and why it can't be only one value.
user avatar
2 votes
1 answer
112 views

kleptography SETUP attack in ecdsa

I'm trying to implement kleptography SETUP attack of ecdsa with python. Just a simply script to verify the algorithm. However i can't get the right output as the paper said. Where is the problem? Can ...
user avatar
  • 31
0 votes
0 answers
60 views

Can the same public key be used for ECDH and ECDSA [duplicate]

I want to generate a public key that I can use to sign messages and receive messages (using ECDH for exemple). I want to do so to have the smallest payload to share. Is it possible and proved secure ?
user avatar
1 vote
1 answer
163 views

Is RSA the only current practical option for asymmetric encipherment of symmetric keys at rest?

As of 2021, is RSA the only practical (i.e. safe, production-ready) option for asymmetric encipherment of symmetric keys at rest? ECDSA is obviously preferable over RSA in the case of signing, but (...
user avatar
  • 3,357
1 vote
1 answer
57 views

Find the product of two sums via SMPC

I'm currently working on a distributed threshold DSA scheme that requires to find the product of two sums via secure multi-party computation. Specifically speaking, every one of $n$ parties $P_i$ ...
user avatar
0 votes
1 answer
109 views

Chinese remainder theorem in ECDSA for parameters in secp256k1?

It is known that it is possible to apply the Chinese remainder theorem and attack RSA under precise conditions. https://tls.mbed.org/public/WSchindler-...
user avatar
  • 3
1 vote
2 answers
214 views

Is the verification process in ECDSA the same or different from in RSA?

With an RSA key pair, from my understanding, Alice who holds the private key is able to encrypt a message into a signature. She would then send the signature together with her original message to Bob. ...
user avatar
  • 183
1 vote
1 answer
60 views

Confusion over recovery of privatekey in DSA signature when duplicate value of r occurs

In DSA signature where signing is done via $$s = k^{-1}(H(m) + xr) \mod{q} $$ I understand why if two messages singed by the same private key $x$ use the same $k$ value you can recover the private key ...
user avatar
3 votes
1 answer
190 views

Why check for point-at-infinity during ECDSA verification?

The ECDSA standard mandates that during verification we check that an intermediate calculation does not lead to the point-at-infinity (see Step 5. in this summary on Wikipedia ). But why do we check ...
user avatar
  • 2,565
1 vote
0 answers
66 views

Sentinel ("trick") values for lattice attack on DSA with biased k (MSB)

I'm studying lattice attack using this sage script. There are 2 options in script: LSB and MSB. The most interesting option for me is MSB. It recovers private key with less then 100 signatures ...
user avatar
2 votes
2 answers
235 views

Question about coefficient of ECDSA in lattice attack

Update: I made my lattice attack worked finally. As the actual reason is quite complicated I decide to write an answer below to describe how it worked so anyone with similar question might get ...
user avatar
  • 49
1 vote
0 answers
72 views

Security proof about RFC 6979

In the paper: "The Random Oracle Model: a Twenty-Year Retrospective", section 7.3 by Koblitz & Menezes,the authors tried to prove the security of ECDSA+. But after looking at the entire ...
user avatar
0 votes
1 answer
84 views

Why does RFC 6979 need so many loops?

I recently started reading RFC 6979. I'm curious why it needs so many loops. This post asks a similar question: "RFC 6979 - Why not simply hash the message & the private key for deterministic ...
user avatar
1 vote
1 answer
130 views

Why does deterministic ECDSA (per RFC 6979) include the private key in the generation of k?

It's clear that using the private ECDSA key $x$ as an additional input into the hash algorithm, as specified in RFC 6979, doesn't harm security (assuming HMAC_DRBG is a PRF). But is it necessary? ...
user avatar
  • 1,748
2 votes
0 answers
46 views

Randomization of ECDSA signing operations to prevent SCA

A large number of SCA papers that talk about ECDSA mention the need for blinding/randomisation of the signing process, typically with a single-sentence comment about replacing the projective ...
user avatar
  • 347
1 vote
1 answer
90 views

Gennaro & Goldfeder Key Generation Protocol

As I am going through the “Fast Multiparty Threshold ECDSA with Fast Trustless Setup” paper by Gennaro & Goldfeder, 2018, I am stumbled by the key generation protocol (Sect. 4.1, p.10): In Phase ...
user avatar
  • 197
1 vote
1 answer
262 views

Verify that x, y coordinates given as hex string are valid points on an Elliptic Curve [duplicate]

Given the following information: "curve": "P-256", "qx": "729C51D177EBE2079A0FB7B0B3C2145159CF81EC61960E642A1744719AA9F913", "qy": "...
user avatar
  • 11

1
2 3 4 5
9