Questions tagged [dsa]

The Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. It was proposed by the National Institute of Standards and Technology (NIST) in August 1991 for use in their Digital Signature Standard (DSS), specified in FIPS 186, adopted in 1993. A minor revision was issued in 1996 as FIPS 186-1. The standard was expanded further in 2000 as FIPS 186-2 and again in 2009 as FIPS 186-3.

Filter by
Sorted by
Tagged with
1
vote
0answers
18 views

Gennaro & Goldfeder Key Generation Protocol

As I am going through the “Fast Multiparty Threshold ECDSA with Fast Trustless Setup” paper by Gennaro & Goldfeder, 2018, I am stumbled by the key generation protocol (Sect. 4.1, p.10): In Phase ...
1
vote
1answer
25 views

Verify that x, y coordinates given as hex string are valid points on an Elliptic Curve [duplicate]

Given the following information: "curve": "P-256", "qx": "729C51D177EBE2079A0FB7B0B3C2145159CF81EC61960E642A1744719AA9F913", "qy": "...
3
votes
1answer
106 views

Can the security of ECDSA be compromised by the chosen parameters?

The recommended parameters for a secp256k1 ECDSA curve are: (All values are in hexadecimal) ...
1
vote
1answer
29 views

Coin tosses in the context of commitment schemes

I was reading the “Fast Multiparty Threshold ECDSA with Fast Trustless Setup” paper by Gennaro & Goldfeder, 2018 and I encountered this portion (Sect. 2.4, p.6): This excerpt leaves me slightly ...
1
vote
0answers
23 views

Premeditated substitution of ECDSA-signed message by the signer [migrated]

If I understand correctly section 4.2 in Jacques Stern, David Pointcheval, John Malone-Lee, and Nigel P. Smart's Flaws in Applying Proof Methodologies to Signature Schemes, in proceedings of Crypto ...
0
votes
0answers
83 views

ECDSA Algorithm

Let the curve $$y^2 = x^3 + 3x+ 5$$ be defined on $Z_{19}$ . If my private key is $d=4$ what is my public key for $P=(9,1)$ . If $H(M)=4$, find your ECDSA signature for message. Randomize the ...
0
votes
0answers
13 views

ECDSA for EUF-CMA [duplicate]

If I want to prove that the ECDSA (secp256k1) on the blockchain belongs to EUF-CMA, is there any relevant knowledge or literature explaining this part?
2
votes
1answer
44 views

Question about IETF RFC6979 determinisitc (EC)DSA document section 3.6 additional data k'

In RFC6979 document https://tools.ietf.org/html/rfc6979 page 14~15, Section 3.6 "Variants" o. Additional data may be added to the input of HMAC, concatenated after bits2octets(H(m)): ...
6
votes
1answer
120 views

Schnorr groups allowing fast modular reduction, vs GNFS

I'm looking for Schnorr groups allowing fast modular reduction. Say, using the notation in DSA, with 256-bit prime $q$ and 3072-bit prime $p$, and $p\equiv1\pmod q$. Are there standards, RFC, or other ...
0
votes
0answers
65 views

An “unsafe” curve over RSA? [duplicate]

I'm implementing a token server and considering backing them with ECDSA. The options from the library I'm using expose the NIST curves P-256, P-384, and P-521. The safe curves site does not list P-521,...
1
vote
0answers
61 views

Security of an ECDSA Adaptor Signature Implementation

I'm currently working on an implementation of ECDSA Adaptor Signatures, and part of the signature scheme calls for a NIZK proof to verify knowledge of exponent over two public keys that share a ...
2
votes
2answers
203 views

Is it OK to use r-value from ECDSA signature (r, s) to prevent replay attack?

ECDSA signatures are malleable. Given a valid signature (r, s), one can create a second valid signature by negating the s value. I have searched workaround for this issue, and https://yondon.blog/2019/...
5
votes
1answer
540 views

What is the Lord of the Ring(s): Side Channel Attack and What are the results

A recent Paper to appear on USENIX Security 2021 titled as Lord of the Ring(s): Side Channel Attacks on the CPU On-Chip Ring Interconnect Are Practical by Riccardo Paccagnella Licheng Luo Christopher ...
0
votes
1answer
141 views

How to compare the time of encryption, cracking and verification elliptic curve problem in the same framework?

everyone! As a beginner, I would like to ask you a question. The best algorithm known for cracking (done by anonymous snooper) this problem (Discrete logarithm problem of elliptic curve or ECDSA)is ...
0
votes
1answer
63 views

Elliptic curve in Binary Field implementation

For Elliptic curves defined over $GF(2^n)$, by adding any two points P and Q over $GF(2^n)$ we get the third point over $GF(2^n)$. In Elliptic Curve Digital Signature Algorithm (ECDSA) https://en....
1
vote
1answer
116 views

How did this group discover m wasn't random?

In this video a group of "hackers" describe how they discovered private keys for the PS3 that was using this ECDSA algorithm by discovering that the "random" integer $m$ (or $k$ in ...
0
votes
0answers
61 views

Guarding against vulnerabilities for a digital signature service (RSA )

Lets's say I have a cipher-module / cryptography-service that signs a hash of some unknown payload. What are the possible attacks that I would need to guard against in this context (primarily assuming ...
1
vote
1answer
45 views

ecdsa nonce reuse to compute the private key, modular inverse question

I am following along some cryptography challenges:, in particular ECDSA Nonce Reuse here (second problem): https://blog.coinbase.com/capture-the-coin-cryptography-category-solutions-fe94d82165c5 I ...
1
vote
1answer
76 views

Security level of DSA when $q$ is a 224 bit prime?

What is the security level of DSA algorithm when $q$ is a 224 bit prime? Is it always a simple rule that the security level is the bit length of $q$ divided by two ?
1
vote
0answers
164 views

Calculating ECDSA Private Key From Multiple Signatures With Shared k (random nonce)

I've been experimenting with ECDSA signatures and with how the Sony PS3 private key was leaked. Specifically where: $$k = \frac{z_1 - z_2}{s_1 - s_2}$$ $$d_A = \frac{z_1s_2 - z_2s_1}{k(s_1 - s_2)}$$ ...
3
votes
0answers
92 views

How can the Number Field Sieve attack the discrete log in $\mathbb Z_p^*$ of DSA?

The Digital Signature Algorithm (DSA) uses $L$-bit prime $p$ and $N$-bit prime $q$ with $q| p-1$, i.e., $p = r\cdot q +1$ ( Schnorr group if $r>2$ and safe prime if $r=2$). In a way, the security ...
1
vote
1answer
17 views

DSA parameter selection

In the Digital Signature Algorithm, is there a reason why the larger prime parameter should be an $N$-bit prime where $N$ is a multiple of 64 ? Is this strictly necessary for proper working of the ...
1
vote
0answers
66 views

ECDSA sign test vectors

I've seen a large set of ECDSA test vectors for verification. In addition, I've seen some test vectors from NIST, and those can be found here. Is anyone aware of ECDSA sign test vectors which, if &...
1
vote
0answers
52 views

Understanding multiplication of Shamir secret sharing during threshold (EC)DSA signing

I have been looking at the threshold (EC)DSA schemes for honest majority by Gennaro et al. https://www.sciencedirect.com/science/article/pii/S0890540100928815. In the scheme, there are steps where we ...
1
vote
1answer
87 views

Can ECDSA signature signing and verification process replaces password hashed based login system?

ECDSA or DSA in general was to sign a message or data using private key and verify it using public key, if the attacker/imposter doesn't have the private key then they couldn't sign the message ...
1
vote
1answer
109 views

Does it make any sense to hash parts of a hashing target?

TL;DR; Assuming I'm calculating SHA256 for an ECDSA, does it make sense to do SHA256(item1 + SHA256(item1') + item2 + SHA256(item2') + itemN + SHA256(itemN')) or it'...
0
votes
1answer
81 views

Calculating ECDSA m or k (k or d) when s1 = s2

I recently began to look into some information about obtaining the private key $k$ when two signatures have been produced using the same $m$ and $k$. I've been using the well-publicised information ...
0
votes
1answer
126 views

Calculating the point on the curve during ECDSA signature verification

I'm confused as to how he got (62, 44) as an answer within this article: https://www.coindesk.com/math-behind-bitcoin
0
votes
1answer
126 views

ECDH/ECDSA key exchange on embedded devices

Two devices are communicating only with each other and shall do this with AES encryption. Both devices are offline, have very limited storage and use a small cryptographic coprocessor which is able to ...
2
votes
1answer
96 views

Problem with the signature of message using ECDSA over GF(2^m)

I'm trying to set up an ECDSA with Elliptic Curves over $\operatorname{GF}(2^m)$ with an example of toy with the following values: Using the Weierstrass equation on binary finite fields. $$E: y^2 + x*...
0
votes
0answers
33 views

Which signature is considered more secure and has less communication cost?

This article uses Elliptic Curve Cryptography, but when it comes to signing and verifying messages it is not using the ECDSA signature algorithm. In the article, they mentioned that the communication ...
0
votes
0answers
57 views

Is this a good implementation of digital signature with timestamp?

Is this a good practice ?. How good or bad is this compared to appending a timestamp to the actual data and hashing it as represented below. ...
0
votes
0answers
50 views

Can private key used in ECDSA be discovered when many signatures were colleced? [duplicate]

Can private key used in ECDSA be discovered when many signatures of different messages were collected (1M+) or may signatures of the same message were collected? Will small nonce bias be easily ...
0
votes
0answers
67 views

Vulnerability in the Digital Signature Algorithm. Can I calculate k and x?

I feel DSA is vulnerable if k is randomly selected over a small set, example, {1,2,...,2^16 -1}. I am trying to come up with a program where I assume I have the public parameters (p,q,g) , public key :...
0
votes
2answers
127 views

The Generator point and Mod P in ECDSA

I've been reading about The discrete logarithm problem as of recent and i decided to try it out on a small portion of numbers myself and i actually came to a mental gridlock after watching this Video....
2
votes
1answer
155 views

How is EdDSA different from ECDSA with a custom curve?

I just found this draft/informal IETF specification: Alternative Elliptic Curve Representation: This document specifies how to represent Montgomery curves and (twisted) Edwards curves as curves in ...
1
vote
2answers
86 views

Can the ECDSA still work without present of hashing function? [duplicate]

According to walkthrough steps for ECDSA topic from wikipedia as shown below, What if the impact if we don't apply the hashing function (highlighted in blue in the image) to the raw messages? Although ...
1
vote
2answers
80 views

Using different hashing function with ECDSA

I came across an IC device configuration & security flow and the details are illustrated in image below. I'm wondering must the ECDSA pair with the SHA Hashing function? Alternatively, what if ...
1
vote
1answer
72 views

What is the use of pre-computed points in ECC?

I am trying to understand the use of pre-computed points in ECC for ECC signature, verification, key generation, and so on. After searching on the internet, I understand that pre-computed points aid ...
0
votes
1answer
91 views

TLS 1.2 Server Key Exchange problem

Below the Wireshark snapshot of the handshake compliant to the TLS 1.2. The position 1 displays the enum ServerECDHParams where I can use any curve having the own ID RFC8422. I'm free for example to ...
0
votes
0answers
63 views

how to efficiently compute private key in DSA with known parameters

For textbook DSA, as defined below. If $r, s, k, g, p, q, m$ are all known, is it possible to efficiently compute $x$ from all these given values? How does the math work out? Secret key: $x\stackrel ...
2
votes
2answers
193 views

ECDSA signature generation and verification latency

I am performing some measurements of P256 ecdsa signature generation and verification latency and I was expecting that the signature verification will be faster than the signature generation, but is ...
3
votes
0answers
82 views

Constant time arithmetic implementation in DSA

I am trying to understand why it is a hard problem to have formally verified constant time arithmetic for DSA when compared with ECDSA. For instance, in ECDSA implementations of OpenSSL, we have ...
0
votes
0answers
79 views

Cryptanalytic tests for biased nonces

In the paper Biased Nonce Sense: Lattice Attacks against Weak ECDSA Signatures in Cryptocurrencies on section 5.2 Cryptanalytic tests for biased nonces, one of test is: Select two signatures at ...
4
votes
1answer
128 views

ECDSA: with knowledge of private key, can we make signatures with partially chosen content?

In ECDSA, with knowledge of private key, can we make signatures with partially chosen content? Detailing that: In ECDSA (with secp256r1 curve and SHA-256 hash), assume we know the private key, the ...
5
votes
2answers
2k views

Difference between X25519 vs. Ed25519

I am reading https://en.wikipedia.org/wiki/Curve25519 and it states Also in 2018, RFC 8446 was published as the new Transport Layer Security v1.3 standard. It requires mandatory support for X25519, ...
1
vote
1answer
105 views

Can you use ECDSA on pairing-friendly curves?

I'm learning about Elliptic curve cryptography. If I understand right, ECDSA and other algorithms used in ECC are dependent on the curve chosen. So, before you want to use ECDSA, you first have to ...
1
vote
1answer
135 views

Is it possible to safely implement the Signal Protocol (X3DH) without using XEdDSA

In the X3DH specification of the Signal Protocol it mentions having a signed pre-key in the key bundle. This pre-key is signed using the identity private-key. Because the identity private-key is in ...
1
vote
1answer
342 views

How Does Prime Factorization Break ECDSA?

I have heard that ECDSA will be broken in the not-to-distant future (roughly 15-25 years) by Quantum Computers running Shor's Algorithm. However, to my understanding, the only purpose of Shor's ...
2
votes
0answers
56 views

Security problems if ECDH and ECDSA use the same key [duplicate]

Hy! I want to use an EC key for ECDH and ECDSA too. Using the same key does compromise the security of the key in a cryptographic / mathematical sense? I read a lot in this theme, but I found nothing ...

1
2 3 4 5
9