Questions tagged [dsa]

The Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. It was proposed by the National Institute of Standards and Technology (NIST) in August 1991 for use in their Digital Signature Standard (DSS), specified in FIPS 186, adopted in 1993. A minor revision was issued in 1996 as FIPS 186-1. The standard was expanded further in 2000 as FIPS 186-2 and again in 2009 as FIPS 186-3.

Filter by
Sorted by
Tagged with
1 vote
1 answer
35 views

Recovering the curve-point R from a signature ECDSA

When recovering the public key from ECDSA signature (r, s), the first step is recovering the point R. You do this by plugging in (r + xn) into the curve equation where n is the order of the basepoint ...
  • 11
2 votes
1 answer
157 views

Why must ECDSA verification ensure the point is on the curve?

In ECDSA, when parsing the public key a test is made to ensure the public key really lies on the curve. What vulnerabilities appear if one does not do this?
  • 51
2 votes
0 answers
49 views

Forging an ECDSA signature for a random public key string

An adversary is able to insert a random string (which he does not control: he can only randomly generate it and insert it). The random string is parsed by the victim as an ECDSA public key. This ...
  • 51
2 votes
1 answer
96 views

What degree of k bias is acceptable in ECDSA?

So there’s LadderLeak. RFC6979 produces uniformly random nonce $k$. There are other techniques, such as hash-to-curve standard (draft-irtf-cfrg-hash-to-curve-16 section 5), which allows to produce ...
0 votes
0 answers
19 views

Digital Signature Algorithm(DSA) without hashing the message? [duplicate]

I am learning about various digital signatures and came across DSA. In DSA, the $s$ part of the signature has a hash of the message $H(m)$. I was wondering, why can't we just use the message $m$ ...
1 vote
1 answer
203 views

ECDSA SECP256k1 curve - same-r-value-is-used-for-two-different-addresses

Edited: changing the notation according request by fgrieu. I have prepared 4 transactions for 2 pubkeys with the same r1 and r2. properties of secp256k1: ...
  • 11
2 votes
1 answer
60 views

ECDSA-SHA256 HTTP Signature String Construction

I must verify an HTTP signature to guarantee the origin and integrity of a webhook data: https://www.blockcypher.com/dev/bitcoin/#webhook-signing This is their x509 PKIX encoded signing key's public ...
  • 33
1 vote
0 answers
39 views

Verifying ECDSA-SHA256 HTTP Signature [duplicate]

With PHP, I'm trying to setup a HTTP signature verification for webhook requests coming from BlockCypher: https://www.blockcypher.com/dev/bitcoin/?php#webhook-signing This is their public key: ...
  • 33
1 vote
1 answer
37 views

Can a quantum attacker prove that incomplete ECDSA signatures were produced with the same key?

Assume a 256-bit ECDSA private key used with Secp256k1 and SHA-256. This key signs multiple different messages in a fully deterministic manner as described in RFC-6979, so signing the same message ...
  • 43
3 votes
2 answers
97 views

Given multiple incomplete ECDSA signatures, what can a quantum attacker learn in the following scenarios?

Assume a 256-bit ECDSA private key used with Secp256k1 and SHA-256. This key signs multiple different messages in a fully deterministic manner as described in RFC-6979, so signing the same message ...
  • 43
2 votes
0 answers
25 views

Fusion auth versus jose4j library for jwt using secp256k [closed]

I am a beginner in-terms of JWT libraries in programming. How the keypair used (secp256k1) is related with the algorithmic header used for creation of JWT? And why authfusion doesn't need an ...
3 votes
3 answers
1k views

How can we reverse Elliptic Curves after solving the DLP problem?

Suppose that I've solved the Discrete Logarithm problem. Can someone explain to me in terms of the example below how to arrange values of Elliptic Curve secp256k1 in a reverse form so that I can ...
0 votes
1 answer
115 views

Solve discrete logarithm with new chinese research

Does this research also work for breaking bitcoin ECDSA? If so, how many qubit will be needed for 256-bit elliptic curve key?
user avatar
2 votes
0 answers
71 views

Could classical computers end up breaking the ECDLP through prime factorization (GNFS)?

Is there any way in which classical computers oculd end up breaking ECDLP. I read that GNFS could through prime factorization, but I am not sure if I understood this properly.
  • 51
3 votes
2 answers
275 views

How could ECDSA be broken with prime factorization through Shor's Algorithm?

could anyone help me understand how is ECDSA broken using Shor's Algorithm? All the papers I find are too complex to understand, and even though I feel I understand some concepts, some others are a ...
  • 51
1 vote
0 answers
40 views

ECDSA security proof in random oracle

I need to know if there is a security proof for ECDSA in the Random Oracle model?
  • 51
1 vote
2 answers
217 views

Convert a Schnorr Public Key to a compressed ECDSA Public Key

Given a Schnorr Public Key (32 bytes) x, I'd like to generate a compressed ECDSA Public Key (33 bytes) and thus be able to generate the bitcoin address that the private key holder can generate with ...
2 votes
1 answer
71 views

Is a single digital signature (ECDSA) of an encryption key (AES) enough to verify the legitimacy of all encrypted messages?

I have an encryption scheme set up with a client and server that utilizes AES 256. What I am curious about is whether or not all information sent from the server to the client can be verified as ...
1 vote
1 answer
47 views

Mod operation while verifying an ECDSA signature with SECT233R1

I'm trying to perform ECDSA verification in hardware. I'm using the SECT233R1 curve (NIST B-233). I have a question about the hash function used while doing so. I want to use the SHA256 hash function ...
2 votes
0 answers
203 views

ECDSA Common Nonce Reuse Attack

so I recently stumbled upon this video by @bertcmiller who created two transactions with the same nonce "k". That seen I researched quite a lot of pages explaining how to recover the private ...
2 votes
0 answers
56 views

What is the advantage of ECDSA over Schnorr signature?

As we know, the Schnorr signature enjoys the linearity property, which does not exist in ECDSA. It seems the Schnorr signature is more efficient and can bring more features than ECDSA. What is the ...
  • 777
2 votes
1 answer
215 views

Create a new signature from existing DSA signatures

Is it possible to generate a new valid signature for some arbitrary message using DSA if we know existing signatures for the same message? We are an adversary, therefore we do not hold the private key,...
  • 21
1 vote
1 answer
266 views

How to know if a public key has been created based on the ECDSA algorithm?

Suppose in a network, the identity of users is their public key, which is generated based on the ECDSA algorithm. That is, to create a valid identity, a user must generate an ECDSA public key and then ...
1 vote
2 answers
421 views

Recovering nonce in ECDSA with known shared components in ECDSA

This is a slight variation of the shared nonce problem. We do have a lot more shared information between two nonces. Given a random $k$: $$ k_1 = ka, k_2 = kb $$ I am now signing two messages, which ...
0 votes
1 answer
81 views

Is it impossible to extract any data from an ECDSA signature of hashed data

I am trying to write a function that, given an EIP712 ECDSA signature, verifies the signature was signed by a particular person, and then (somehow) retrieves the information that is encoded in the ...
3 votes
1 answer
143 views

Does ECDSA leak information about the message hash?

ECDSA works by computing the hash of a message and then computing the signature for it. ECDSA uses the signature: $$s = k^{-1}(h + rp_{pr})\,\textrm{mod } n,$$ where $n$ is the order of the group, $k$ ...
  • 131
5 votes
1 answer
96 views

Consequence of improper validation in point decompression?

Assume a standard ECC curve in a prime field $\mathbb F_p$ with $p\equiv3\pmod 4$, such as secp256k1; and code turning a bytestring for a compressed ECC public key into an Elliptic Curve point, that ...
  • 132k
0 votes
1 answer
42 views

Can there be different private keys for the same public key in DSA?

From the Wikipedia page for DSA(Digital Signature Algorithm) we have the following private/public key generation: Choose an integer x randomly from [1, q-1] Compute y := g^x mod p x is the private ...
4 votes
1 answer
349 views

Is a padded 128 bit private key enough for ecdsa 256?

According to the following, ecdsa-256 only provides ~128 bit security even for 256 bit private key: A multi-target attack on 128-bit ECDSA private keys If the private key has only 128 bit entropy but ...
  • 143
1 vote
0 answers
72 views

Using a signature as key material

I am designing my first web3 app and I would like to use MetaMask as an identity and crypto provider. My web3 app will encrypt user data with AES-GCM, but I do not want to generate and store an ...
  • 11
1 vote
1 answer
83 views

Non-determnistic ECDSA: is there any unique common factor of all signatures of the same message by the same private key?

For non-deterministic ECDSA: Given message $m$ and private key $p$, produce a series of signatures $s_i = signature(p,m)$, $i=[1,n]$. Does there exist some function $f$ such that $j_i=f(s_i)$ and $j_1=...
  • 113
3 votes
1 answer
286 views

What's the problem with ECDSA and SHA-3?

To quote Ilari on the CFRG mailing list: e.g. the vile mess that is ECDSA with SHA-3 I have some ideas what he might mean but I couldn't find the discussion so what is that mess?
  • 4,883
0 votes
1 answer
240 views

Difference between DSA and RSA in terms of signature generation

For DSA, if the same message is signed multiple times on different occasions, the signatures will differ because the random value k is generated for each signature. This is not true of RSA signatures....
2 votes
2 answers
340 views

Are digital signatures unique for the messages they sign?

Practical implementations of digital signature algorithms (DSAs) employ hash functions to ensure that input is small and of a fixed sized; otherwise, DSAs would be too slow for most real-world ...
1 vote
1 answer
947 views

Can OpenSSL sign an ED25519 certificate with ECDSA-with-SHA256?

We are trying to generate some self-signed certificates to test our cybersecurity firmware before switching to a "real" CA-signed chain of trust. The specification we are coding to mandates ...
2 votes
2 answers
201 views

Security Level of DSA given parameters

So I'm trying to compare different digital signatures, and thus I stumbled upon a DSA algorithm. I'm using python's cryptography library, and it offers following values for L and N: L=1024,N=160 L=...
  • 43
2 votes
1 answer
143 views

ASN.1 integer question for DSA

I'm trying to implement own DSA signature check as per guide at this site page 20 in python. ...
1 vote
1 answer
83 views

Working with Paillier and ECDSA - Order issue

I'm trying to implement two party computation for ECDSA signing using Paillier cryptosystem. But my problem is that the order of Paillier is different from the order of the curve (secp256k1 in my case)...
  • 123
1 vote
1 answer
53 views

Secure modification of DSA?

In DSA, we compute the signature $(r,s)$ on $m$ by sampling $k\in\{1,...,q-1\}$ and then computing $r := g^k \bmod p$ $s := k^{-1}*(m+x*r) \bmod q$ During verification, we compute $v:=g^{m*s^{-1}}*y^{...
  • 519
0 votes
0 answers
562 views

ECDSA private key recovery

I have a bunch of signatures (1000) signed with ECDSA secp256k1 curve. I can verify all of them with the same public key. I have studied attacks are performed against ECDSA signatures using known MSB ...
0 votes
0 answers
41 views

Consider the DSA digital signature scheme. Does the intercepted message m||s||r contain all information about the signer’s private key?

Consider the DSA digital signature scheme. Does the intercepted message m||s||r contain all information about the signer’s private key? Please justify your answer carefully. Please note that the ...
  • 1
1 vote
0 answers
177 views

What data can be derived from ECDSA signature and message?

I generate a random message m sent to a device that calculates sig(m, privKey) with secp256k1...
  • 11
3 votes
1 answer
410 views

Strauss-Shamir trick on EC multiplication by scalar

I'm studying ECDSA, and almost all somewhat detailed articles talk about using Strauss-Shamir trick on the verification step. Then I searched, and found this explanation (more like a stating) for the ...
  • 195
3 votes
1 answer
329 views

Is it theoretically possible to delegate public key generation?

Imagine the following scenario: In a given cryptocurrency, privacy should be as high as possible. For this purpose, a new account with a new address is created for every incoming transaction (the ...
2 votes
1 answer
223 views

Why is r used in ECDSA signature while R in Schnorr signature?

In Schnorr signature (R, s), R is used. But in ECDSA signature (r, s), r is used, which is the x-coordinate of R. Why the difference?
2 votes
1 answer
397 views

Can I generate two similar ECDSA public keys?

I am using a system that relies on base64 encoded ECDSA public keys. I have managed to brute-force a public key that when encoded starts with a word I like. Is it possible for me, given the private ...
  • 23
1 vote
1 answer
89 views

MAC vs MDC when using ECDH+ECDSA in OpenPGP

I intend to design a model to comply with RFC4880. According to RFC6637, ECC in OpenPGP +ECDSA to sign message +ECDH + KeyWrap for session key encryption -MAC: is used for key confirmation (with C(1e, ...
  • 51
2 votes
1 answer
241 views

Is DSA still secure without the factor "r"?

If I understand correctly, the way DSA in a group $G$ with a hash function $H$ works is: Peggy (signer) has a private/public key pair $x$, $g^x$. For signing, she produces a random session key $k$, $g^...
  • 23
1 vote
1 answer
93 views

Is f(G) uniform under the described condition in ECDSA?

In ECDSA, $f(G)=r$, where $r$ is the $𝑥$-coordinate of group element $G$. Now it is known that $f(G)$ is not uniform(Why isn't $f(G)$ uniform in ECDSA?). Then in which range $f(G)$ is uniform? Let $\...
  • 777
1 vote
1 answer
361 views

Shor's algorithm and ECDSA in Bitcoin - why is finding the private key still difficult when we know the base point?

I'm learning about Shor's algorithm and how it can be applied to break ECDSA. I've clearly missed something basic here - I thought I understood that the challenge ECDSA presented was to find the ...
  • 13

1
2 3 4 5
10