Skip to main content

# Questions tagged [dsa]

The Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. It was proposed by the National Institute of Standards and Technology (NIST) in August 1991 for use in their Digital Signature Standard (DSS), specified in FIPS 186, adopted in 1993. A minor revision was issued in 1996 as FIPS 186-1. The standard was expanded further in 2000 as FIPS 186-2 and again in 2009 as FIPS 186-3.

533 questions
Filter by
Sorted by
Tagged with
1 vote
0 answers
45 views

### ECDSA biased nonce with biased middle bits

The paper "Biased nonce sense" (https://eprint.iacr.org/2019/023.pdf) covers key recovery for MSB and LSB, the latter case being handled by doing modular inverse of 2 to the power of the ...
• 11
1 vote
0 answers
61 views

### Does unlimited signing oracle leak the private key?

I am writing a PC software that uses a type of USB dongle as licensing key. The dongle functions as a signing oracle and does nothing more: Given any message $M$, it first pads $M$ to $PadM$, then ...
• 111
1 vote
1 answer
94 views

### RFC6979: Can deterministic ecdsa signature diverge with same key and message?

As I understands, RFC6979 uses deterministic K which is generated by HMAC-SHA256(private_key, message). In this way, I guess if same key with same message, ecdsa signature generated would be always ...
• 33
1 vote
0 answers
89 views

### Math of Hint usage in Dilithium

For Dilithium, I understand that $$\text{HighBits}(\mathbf{Ay}) = \text{HighBits}(\mathbf{Ay} - c\mathbf{s_2}) = \text{HighBits}(A_z - c\mathbf{t})$$ The first term of the equation is performed on the ...
• 31
1 vote
1 answer
95 views

### Is it possible to break a DSA with k that increases statically?

I am currently studying cryptography. I came across this problem: I had an exercise that as a vulnerability had that k is generated every 10 seconds: ...
• 11
1 vote
0 answers
189 views

### Need help with Cryptohack's ProSign 3 ECDSA problem [closed]

I'm trying to solve the CTF challenge called ProSign 3 at Cryptohack platform which involves exploiting an ECDSA signing service that allows us to sign a fixed message being padded with the time ... ...
2 votes
1 answer
86 views

### Small subgroup attack when using a Schnorr group for DHKE

One uses a Schnorr group both for Schnorr signature (or DSA), and for Diffie-Hellman Key Exchange. They target 128-bit security, and choose prime $q$ that's 256-bit, prime $p=q\,r+1$ that's 3072-bit, ...
• 142k
1 vote
0 answers
56 views

### Single ecdsa signature valid for two different messages

I have been reading Flaws in Applying Proof Methodologies to Signature Schemes and ran into a bit I do not understand. In section 4.2 the authors describe a scheme where a malicious signer crafts a ...
1 vote
1 answer
68 views

0 votes
0 answers
48 views

### Is this ECDSA's protection mechanism or something wrong with it?

Over the past few months, I have been reading and trying to understand how ECDSA works and how safe is it. So now something does not add up between its signature verification and generation. But maybe ...
0 votes
0 answers
56 views

### Framework for manipulating digital signatures

for a research project, i am currently looking for a way to manipulate the digital signature of a HTTPS TLS message flow. More specifically, i am trying to create a working example for a malicious ...
2 votes
0 answers
139 views

### Can lattice attack work MSB or LSB are unkown but 16 bytes of private key are known?

I have been reading about lattice attack on ECDSA when partial bits of nonce are known for amount of signatures, So i went through some source code trying to understand how it works. First of all, ...
0 votes
0 answers
70 views

### Same message different nonce but similarities in r value of the signatures(r,s)

I'm studying a case where when i sign a same message with the same private key and a different nonce, i sometimes get signatures (r,s) where r values share some similarities (same numbers at the same ...
• 101
0 votes
0 answers
47 views

### Practical deployments of ECC with cofactor of elliptic curves $4$ or $8$?

Are cofactor $4$ and $8$ ECC schemes widely used in practical deployments such as those in cryptocurrencies? Can you name some practical settings where there curves are used and cryptocurrencies where ...
• 930
2 votes
1 answer
271 views

### Does RFC 6979 unconditionally prevent nonce-reuse attacks?

Is RFC 6979 guaranteed to prevent the reuse of nonces for different signed hashes?
• 3,655
1 vote
2 answers
68 views

### In ECDSA over K256, Why R.x should be less than the subgroup order, not field order? But in BIP340 over K256, should be less than field order

I understand that R.x is a field element. I don't understand why in ECDSA verification ie. FIPS 186-5 section 6.4.2 step 1, we check whether r is less than subgroup order. If it has something to do ...
• 155
3 votes
1 answer
89 views

### Why are there two Challenges in the DSA Identification Scheme?

Would either $\alpha$ or $r$ suffice as challenge? I am aware that the signature and verification were to adapt. However, what is the motivation behind using two challenges?
0 votes
1 answer
81 views

### Reason for two random numbers in DSA?

Why is the signature in DSA the way it is? I am referring to $r$ and $k$ in the Signing-Algorithm depicted below. Is it really necessary to have both, $r$ and $s$, or would it still be secure if only ...
0 votes
1 answer
57 views

### Using plaintext + ciphertext combination as substitute for authentication/signature in elliptic curve cryptography

I'm working on a system where I need to sign some data using an ECC private key and share the data and signature over a BLE ADV packet. Since an ADV packet is limited in space, I can't use a full ...
1 vote
0 answers
22 views

### In DSA, can we tell if signatures are for the same key pair?

We are given some distinct DSA signatures $(r_i,s_i)$ and the distinct hashes $H_i$ of the corresponding messages. The signatures and messages are non-maliciously made per the same known group ...
• 142k
2 votes
2 answers
292 views

### Can we recover public key from DSA signatures as we can from ECDSA?

I learned the Public Key Recovery algorithm for ECDSA, and wonder if we can use it in DSA. The answer seems to be no, but details are welcome.
• 23
1 vote
1 answer
125 views

### Understanding the Communication Protocol of Apple HomeKey

I am currently analyzing the communication protocol of HomeKey. Here are two traces between the lock (reader) and the device (card). First set: ...
• 111
3 votes
1 answer
920 views

### When using ECDSA P-384 for signing and verifying messages, should the public key be also included **INSIDE** the message before signing?

I am using ECDSA P-384 for signing and verifying messages. The messages are basically stringified JSON. After receiving, the recipient verifies the signature using the public key. Should the public ...
2 votes
1 answer
626 views

### ECDSA simpler formula?

In ECDSA, if Alice wants to send a message to Bob, she computes $s=k^{-1}(z+rd_A)$. I was thinking that the formula could simply be $s=k^{-1}zrd_A$ and the algorithm would work just as well, and the ...
• 23
0 votes
0 answers
108 views

### Apple secure enclave with RFC6979

Does Apple secure enclave support rfc6979 with P256 curve? This RFC defines a deterministic ecdsa with a deterministic k value. THATS LINK OF THE RFC https://www.rfc-editor.org/rfc/rfc6979 I looked ...
4 votes
1 answer
184 views

### ECDSA (ecrecover) - How an attacker can construct a hash and signature that look valid

I found information, that it is possible to construct a hash and signature that look valid if the hash is not computed within the contract itself (we are talking about ECDSA/ecrecover here). So, the ...
• 143
1 vote
0 answers
423 views

### JavaScript SubtleCrypto - Is there a way to convert the ECDSA keys into a more "portable" format and preferably shorter? [closed]

I asked this question on StackOverflow but it seems like it's more appropriate for this Crypto community. I am using the browser built in SubtleCrypto library in javascript to generate public and ...
6 votes
1 answer
205 views

### What's the current status of development of hedged ECDSA and EdDSA?

In the IETF Draft Deterministic ECDSA and EdDSA Signatures with Additional Randomness, methods had been specified to seed RNG deterministically with external input, to securely obtain a nonce for use ...
• 9,451
5 votes
1 answer
93 views

### Securely derive multiple EC keys from master EC key and prove it

Alice has master EC key pair: $a$ - private key, $A$ - corresponding public key Bob generates 2 random integers $r_1$ and $r_2$ and wants Alice to derive 2 new key pairs: $a_1$ = $a$ + $r_1$ and $a_2$ ...
• 149
2 votes
0 answers
23 views

### Back2back addition with Jacobian Coordinate

I implemented below algorithm in hardware and it works fine with first point addition. However, when I continue to perform back-to-back addition, I got the wrong result. The part that I'm not sure ...
• 83
2 votes
0 answers
23 views

### Which channel protocol should I use to broadcast the message between parties?

I am building the Threshold Signature Scheme (TSS) based wallet. I would like to run the each party's node separately with different host. And these nodes should be able to send the messages through ...
3 votes
0 answers
212 views

### Prove DSA signature scheme is EUF-CMA secure

I want to prove that the DSA signature scheme is EUF-CMA secure in the random oracle model, if the discrete logarithm problem is hard. I know it can be proved by the following two parts: Discrete ...
• 31
0 votes
1 answer
144 views

### Multiplicative Inverse in Point Addition/Point Multiplication

Walkthrough the textbook content, understand that we need to compute the slope of 2 points before can compute the new point as the result of addition. Multiplicative inverse is part of the operation ...
• 83
1 vote
1 answer
54 views

### How to authenticate multiple IOT devices having unique certificates (ECDSA)?

I'm relatively new to the field of security. I'm working on an IoT system with WiFi-connected nodes (Bio-sensing devices) communicating with a server for centralized monitoring. I need to authenticate ...
• 13