# Questions tagged [dsa]

The Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. It was proposed by the National Institute of Standards and Technology (NIST) in August 1991 for use in their Digital Signature Standard (DSS), specified in FIPS 186, adopted in 1993. A minor revision was issued in 1996 as FIPS 186-1. The standard was expanded further in 2000 as FIPS 186-2 and again in 2009 as FIPS 186-3.

326 questions
Filter by
Sorted by
Tagged with
30 views

### ECDSA secp256k1 attacks

Are there any known and feasible ECDSA attacks on secp256k1 which can reduce the bit security of the algorithm? For example from 256 bits of security down to 192 bits?
30 views

### Can anyone explain me Schoof's Algorithm to find the order of the elliptic curve?

I am working on ECDSA algorithm. I'm trying to code it in nodejs. Firstly, I need to generate a private and public key. For public key, I need the cofactor, which is the division of the order of the ...
33 views

### ECDSA public key point uniqueness [duplicate]

I'm new to ECDSA and there is something I still not sure about. If I have a classic Certificate Authority server that delivers PEM certificates containing public key with ECDSA, I can retrieve the ...
32 views

### ECDSA dA multiplication algorithm [duplicate]

I was looking at this question and i cant understand this part: QA = dA G = 5 (5,1) = (9,16) I saw that algorithm used for this was Double-and-add algorithm but i didn't get it. Can ...
60 views

### If I have two ECDSA signatures that use the same k (nonce) but different secret keys, can the secret key be computed? [duplicate]

I have two ECDSA signatures $(r, s_1, z_1)$ and $(r, s_2, z_2)$ where $s_1 = (z_1 + r*x_1) / k$, and $s_2 = (z_2 + r*x_2) / k$. Can $x_1$ & $x_2$ be computed?
41 views

### Lookup table for DSA/ECDSA/Schnorr multiplication

Something in common to [EC]DSA and related signature schemes like Schnorr is that the most expensive part of signing is calculating $r = g^k$ in the group for some per-signature $k$ of length $b$ bits....
585 views

### Is it safe to reuse a ECDSA nonce for two signatures if the public keys are different?

We denote the s value of an ECDSA signature $(r, s)$ on a message $m$ as: $s=\frac{H(m)+xr}{k}$ Assume two ECDSA signatures sharing the same nonce $(r, s_1) , (r, s_2)$ on two messages $m_1, m_2$, ...
42 views

### Are EdDSA algorithms encoded by ASN.1 DER standards?

Is it required, or widely practiced to encode a EdDSA signature as a ASN.1 Sequence? Why or why not? How should you encode a EdDSA signature? I cannot find mention of DER or ASN in the EdDSA RFC. ...
3k views

### Digital signature that is only verifiable by one specific person

I would like to digitally sign a message in such a way that the signature can only be verified by one specific person. Simply encrypting the signature will not work, because that person could then ...
56 views

### What would happen in DSA/ECDSA if there were a collision in $r$ but not $k$?

In DSA, the value of $r$ is generated as: $r = (g^k \bmod p) \bmod q$ ECDSA is similar, using the $x$ coordinate of the generator $g$ scalar-multiplied by $k$, again taken modulo $q$. It's well-...
168 views

### Are DSA and ECDSA provably secure assuming DL security?

Is there proof that the DSA construction, also used by ECDSA, is secure assuming that discrete logarithms in the relevant group representation are difficult?
35 views

### Why create a subkey in the digital signature algorithm

In the signing step, wikipedia, a subkey is created. A key k is randomly chosen from 1..q-1. What's the use of that k? If the k is to make less exposure to the ...
30 views

### Zero Knowledge Proof of Association

Assuming there are a group of individuals with static ecdsa keypairs, of which the public keys are in a shared database that all of them have access to, how can each participant publish an ephemeral ...
106 views

### Simple math ECDSA example

I'm trying to setup an ECDSA math example using just integer math and multiply (no EC). The purpose is just to help people understand why this works with out the added complication of understanding ...
66 views

### ECDSA signature of a random 32 byte number vs. the hash of the number

I'm working on an application that involves signing a 32 byte random number generated by the OS. Assuming the RNG works as intended, is it safe to sign the random number itself rather than a hash of ...
109 views

### DSA: why using mod p mod q and not just mod p

I'd like to know, in DSA we compute several values modulo $p$ and modulo $q$, like $r = (g^k \bmod p) \bmod q$ or $v = (g^{u_1}h^{u_2} \bmod p) \bmod q$. As far as I understand, we want to use two ...
49 views

### Book request about elliptic curves, RSA and DSA

I understand that this question can be hardly downvoted, but so be it if someone gives me really useful references :) I wanna learn difference (deeply) between RSA, DSA, and ECC, especially I am ...
139 views

### ECDSA signing process

I am trying to learn how ECDSA works. I do not have a background in maths, but have been following a guide which has built me up from finite fields, elliptic curves. I am unable to figure out how a ...
96 views

### Comparison of security definitions for signatures

The two main security definitions for signatures are EUF-CMA and the strong version of it sEUF-CMA. What I see that their difference is that in EUF-CMA experiment, the adversary needs to produce a ...
629 views

### Curve25519 over Ed25519 for key exchange? Why?

I've been reading up on the Signal Protocol (in this PDF) and it seems to be using Curve25519 for ECDH and EdDSA (with Ed25519) for signatures. My question is why not use only Ed25519? This ...
131 views

### Digital Signature Algorithm (DSA) with medium fields

I understand it when we have to solve Discrete Logarithm Problem $a^x\equiv b\pmod p$, where $a$ and $b$ are given integers and we have to find secret integer $x$ that makes the equation true for some ...
141 views

### Why doesn't the formula work when checking two ECDSA signatures?

There are two generated ECDSA signatures X - Private key S = ((Z + (X * R)) / K) mod n S = ((Z + (X * R)) / K`) mod n G - Base point, of order n; ...
202 views

### Which hash is used when providing signature algorithm ED25519 or ED448?

From TLS 1.3 there are two signature algorithms using edDSA: /* EdDSA algorithms */ ed25519(0x0807), ed448(0x0808), All the other signature-...
65 views

### ECDSA - why is the first part of the signature used in the second?

Using the terminology of https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm Why is the second part of the ECDSA signature defined as: $s = k^{-1}(z+rd_A)\text{ mod n}$ ...
118 views

### A missing step in ECDSA signature verification implementation

On the Wikipedia page of ECDSA, it is stated in step 6 of the verification algorithm that If (x1,y1)=O then the signature is invalid. In X9.62, it is also stated ...
40 views

### Where can I find the standard definition for GPG ECDSA signature?

I am playing around with GPG which I'd like to use to sign an integer and use the resulting signature binary in another piece of code. So far I have created a simple PGP packet parser with which I ...
130 views

### Digital Signature Algorithm for large files - bottle-necked by hash function?

I am new to studying digital signatures like ECDSA and EdDSA, and was curious about something. Lets say hypothetically I want to create a digital signatures of millions of files, with a total size of ...
144 views

### Is it important to defend against key substitution attack in ECDSA?

When planning a file signature scheme (basically, just to sign all files content). Is it obligatory to defend against ECDSA key substitution attack? ISO/IEC 14888-3:2018 NOTE 5 states: The ...
35 views

151 views

### DSA signature generation [duplicate]

I am trying to implement given DSA signature generation instructions in python, there are few instructions that I couldn't understand in step 3 and 4. Let m be an arbitrary length message. The ...
177 views

### DSA: How to calculate 224-bit $q$ for 2048-bit $p$

$p$ is a 2048 bit prime number $q$ is a 224 bit prime number I know that $q$ is a prime divisor of $p-1$, thus $p=1 \bmod q$ but I couldn't write efficient code to calculate this. I can calculate ...
223 views

### ECDSA Signing and verifying signatures between Python and JS [closed]

I create a signature on js, here jsrsasign Signatures are obtained in the format: ...
87 views

### Why don't the TLS1.3 cipher suites mention the key exchange and digital signature algorithm in names?

Does it mean both RSA and ECDSA certificates can be used with the same cipher suite?
231 views

### ECDSA with common nounce?

I'm new to cryptography, and I've searching about ECDSA because I'm trying to solve a CTF. I've already check this site and Google, and I think I'm in the right path, but probably I am missing ...
107 views

### Regarding Lattice atttacks on ECDSA with a portion of known bits of the nonce k

I am new in the field of cryptography, and I am having some troubles understanding a concept regarding the lattice dimension needed in the attack on ECDSA using several messages with L known bits of ...
94 views

### Encrypt your ECDSA signature with NTRU to make them quantum secure, does that work?

I have a general question about quantum security. ECDSA is suppose to be broken by quantum computers. Whilst something like NTRU is suppose to be secure. My question is: if we sign with ECDSA and ...
45 views

### Linkable ECDSA like signature [closed]

In our process of digital checks for banking - which needs to work online and offline - the receiver needs to know the chain of all generated signatures without consulting an Internet service. In this ...
208 views

### ecdsa where the group order is larger than the hash size?

According to wikipedia, when generating a signature for ECDSA, you do the following (among other things): Calculate $e=HASH(m)$, where $HASH$ is a cryptographic hash function, such as SHA-2. ...
38 views

### How to prove two ECDSA public keys on two different curves are generated from the same private key [duplicate]

I wonder if I provide someone with two public keys from different elliptic curves, is there any way to prove that these two public keys are generated from the same private key without revealing the ...
278 views

### Why can we not use the group $Z_{p}^{*}$ for cryptography?

Sorry if this is a noob question, but for instance in ECDSA, we start by considering the field $\mathbb F_p$, whose the elements also form a group under multiplication. Why don't we just use this ...
105 views

### Calculating $K,N,X$ in ECDSA?

I'm confused with the parameter $n$, whether the parameter $n$ is the support point FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F or what? ...