Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [dsa]

The Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. It was proposed by the National Institute of Standards and Technology (NIST) in August 1991 for use in their Digital Signature Standard (DSS), specified in FIPS 186, adopted in 1993. A minor revision was issued in 1996 as FIPS 186-1. The standard was expanded further in 2000 as FIPS 186-2 and again in 2009 as FIPS 186-3.

1
vote
0answers
24 views

Zero Knowledge Proof of Association

Assuming there are a group of individuals with static ecdsa keypairs, of which the public keys are in a shared database that all of them have access to, how can each participant publish an ephemeral ...
1
vote
1answer
64 views

Simple math ECDSA example

I'm trying to setup an ECDSA math example using just integer math and multiply (no EC). The purpose is just to help people understand why this works with out the added complication of understanding ...
1
vote
1answer
58 views

ECDSA signature of a random 32 byte number vs. the hash of the number

I'm working on an application that involves signing a 32 byte random number generated by the OS. Assuming the RNG works as intended, is it safe to sign the random number itself rather than a hash of ...
1
vote
1answer
69 views

DSA: why using mod p mod q and not just mod p

I'd like to know, in DSA we compute several values modulo $p$ and modulo $q$, like $r = (g^k \bmod p) \bmod q$ or $v = (g^{u_1}h^{u_2} \bmod p) \bmod q$. As far as I understand, we want to use two ...
0
votes
1answer
42 views

Book request about elliptic curves, RSA and DSA

I understand that this question can be hardly downvoted, but so be it if someone gives me really useful references :) I wanna learn difference (deeply) between RSA, DSA, and ECC, especially I am ...
2
votes
1answer
77 views

ECDSA signing process

I am trying to learn how ECDSA works. I do not have a background in maths, but have been following a guide which has built me up from finite fields, elliptic curves. I am unable to figure out how a ...
4
votes
1answer
76 views

Comparison of security definitions for signatures

The two main security definitions for signatures are EUF-CMA and the strong version of it sEUF-CMA. What I see that their difference is that in EUF-CMA experiment, the adversary needs to produce a ...
3
votes
1answer
297 views

Curve25519 over Ed25519 for key exchange? Why?

I've been reading up on the Signal Protocol (in this PDF) and it seems to be using Curve25519 for ECDH and EdDSA (with Ed25519) for signatures. My question is why not use only Ed25519? This ...
4
votes
1answer
122 views

Digital Signature Algorithm (DSA) with medium fields

I understand it when we have to solve Discrete Logarithm Problem $a^x\equiv b\pmod p$, where $a$ and $b$ are given integers and we have to find secret integer $x$ that makes the equation true for some ...
0
votes
2answers
89 views

Why doesn't the formula work when checking two ECDSA signatures?

There are two generated ECDSA signatures X - Private key S = ((Z + (X * R)) / K) mod n S` = ((Z` + (X * R`)) / K`) mod n G - Base point, of order n; ...
3
votes
2answers
136 views

Which hash is used when providing signature algorithm ED25519 or ED448?

From TLS 1.3 there are two signature algorithms using edDSA: /* EdDSA algorithms */ ed25519(0x0807), ed448(0x0808), All the other signature-...
1
vote
0answers
61 views

ECDSA - why is the first part of the signature used in the second?

Using the terminology of https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm Why is the second part of the ECDSA signature defined as: $s = k^{-1}(z+rd_A)\text{ mod n}$ ...
4
votes
1answer
89 views

A missing step in ECDSA signature verification implementation

On the Wikipedia page of ECDSA, it is stated in step 6 of the verification algorithm that If (x1,y1)=O then the signature is invalid. In X9.62, it is also stated ...
1
vote
1answer
31 views

Where can I find the standard definition for GPG ECDSA signature?

I am playing around with GPG which I'd like to use to sign an integer and use the resulting signature binary in another piece of code. So far I have created a simple PGP packet parser with which I ...
1
vote
3answers
113 views

Digital Signature Algorithm for large files - bottle-necked by hash function?

I am new to studying digital signatures like ECDSA and EdDSA, and was curious about something. Lets say hypothetically I want to create a digital signatures of millions of files, with a total size of ...
6
votes
1answer
105 views

Is it important to defend against key substitution attack in ECDSA?

When planning a file signature scheme (basically, just to sign all files content). Is it obligatory to defend against ECDSA key substitution attack? ISO/IEC 14888-3:2018 NOTE 5 states: The ...
1
vote
0answers
35 views

Proof insecure DSA variant [duplicate]

Consider a variant of DSA in which the message space is $\mathbb Z_q$ and the hash function is replaced by the identity function. (So the second component of the signature is now $s := k^{−1} \...
3
votes
1answer
123 views

Security of Fast Two-Party ECDSA Signing

The paper "Fast Secure Two-Party ECDSA Signing" by Yehuda Lindell describes a system in which two parties, $P_1$ (with 1/2 of a share of a long-term ECDSA signing key $x_1$) and $P_2$ (with the other ...
1
vote
0answers
86 views

ECDSA Message Recovery from Two Encrypted Messages with Signatures and Public Key

I am currently working on a problem where I have two encrypted messages, their corresponding signatures, and the public key. Furthermore, the value of $r$ is the same in the two signatures. I am ...
1
vote
1answer
157 views

Can a TLS certificate using ECC secp384r1 as PK algorithm uses RSA for signature

If a TLS certificate public-key algorithm is ECC secp384r1 or ECC prime256v1, is it possible to have RSA as a signature ...
1
vote
1answer
441 views

What is the recommended minimum key length for ECDSA signature

I want to identify the proportion of certificates that use unrecommend ECDSA key length for TLS certificates based on some data I collected. By looking at a standard like NIST for example, I find ...
5
votes
1answer
226 views

Exactly what RNG weaknesses endanger (EC)DSA?

RFC 6979 defines deterministic variants of (EC)DSA. It states in introduction One characteristic of DSA and ECDSA is that they need to produce, for each signature generation, a fresh random ...
1
vote
1answer
69 views

openSSL and ECDSA key format inspection

If I run openssl ec on a key that I have generated with openssl ecparam -genkey I get one extra prefixing 0x00 in the private ...
5
votes
2answers
105 views

Why ECDSA has its form?

According to Wikipedia, if Alice wants to sign some message, she computes $s = k^{-1} (z + r d_A)$ then sends $(r, s)$ to Bob. I don't understand why they use this particular formula $s = k^{-1} (z + ...
1
vote
1answer
126 views

DSA signature generation [duplicate]

I am trying to implement given DSA signature generation instructions in python, there are few instructions that I couldn't understand in step 3 and 4. Let m be an arbitrary length message. The ...
1
vote
1answer
138 views

DSA: How to calculate 224-bit $q$ for 2048-bit $p$

$p$ is a 2048 bit prime number $q$ is a 224 bit prime number I know that $q$ is a prime divisor of $p-1$, thus $p=1 \bmod q$ but I couldn't write efficient code to calculate this. I can calculate ...
0
votes
1answer
110 views

ECDSA Signing and verifying signatures between Python and JS [closed]

I create a signature on js, here jsrsasign Signatures are obtained in the format: ...
2
votes
1answer
74 views

Why don't the TLS1.3 cipher suites mention the key exchange and digital signature algorithm in names?

Does it mean both RSA and ECDSA certificates can be used with the same cipher suite?
2
votes
1answer
176 views

ECDSA with common nounce?

I'm new to cryptography, and I've searching about ECDSA because I'm trying to solve a CTF. I've already check this site and Google, and I think I'm in the right path, but probably I am missing ...
0
votes
1answer
89 views

Regarding Lattice atttacks on ECDSA with a portion of known bits of the nonce k

I am new in the field of cryptography, and I am having some troubles understanding a concept regarding the lattice dimension needed in the attack on ECDSA using several messages with L known bits of ...
2
votes
1answer
89 views

Encrypt your ECDSA signature with NTRU to make them quantum secure, does that work?

I have a general question about quantum security. ECDSA is suppose to be broken by quantum computers. Whilst something like NTRU is suppose to be secure. My question is: if we sign with ECDSA and ...
1
vote
0answers
42 views

Linkable ECDSA like signature [closed]

In our process of digital checks for banking - which needs to work online and offline - the receiver needs to know the chain of all generated signatures without consulting an Internet service. In this ...
0
votes
2answers
142 views

ecdsa where the group order is larger than the hash size?

According to wikipedia, when generating a signature for ECDSA, you do the following (among other things): Calculate $e=HASH(m)$, where $HASH$ is a cryptographic hash function, such as SHA-2. ...
1
vote
0answers
35 views

How to prove two ECDSA public keys on two different curves are generated from the same private key [duplicate]

I wonder if I provide someone with two public keys from different elliptic curves, is there any way to prove that these two public keys are generated from the same private key without revealing the ...
6
votes
1answer
272 views

Why can we not use the group $Z_{p}^{*}$ for cryptography?

Sorry if this is a noob question, but for instance in ECDSA, we start by considering the field $\mathbb F_p$, whose the elements also form a group under multiplication. Why don't we just use this ...
-2
votes
1answer
87 views

Calculating $K,N,X$ in ECDSA?

I'm confused with the parameter $n$, whether the parameter $n$ is the support point FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F or what? ...
2
votes
1answer
86 views

Can root and intermediate CAs use different asymmetric ciphers and key sizes?

For example, could a root CA use RSA-4096, one intermediate CA use RSA-2048, and another use ECDSA-256 (DH19)?
2
votes
2answers
53 views

Offline authenticated encryption for pub/sub

Requirements: only publisher can create messages publisher & subscriber can both read messages and authenticate the publisher offline message transfer messages can't be read by non-participants ...
4
votes
2answers
135 views

Atomic multi-party commitments

Alice and Bob publicly choose the messages $M_A$ and $M_B$ and independently sign them (Alice privately signs $M_A$, Bob signs $M_B$). Now Alice and Bob are looking for a protocol that allows them to:...
1
vote
1answer
68 views

Known risks for publishing ECDSA public keys and signatures

For an implementation of ECDSA, I'm considering the risks of publishing public keys together with multiple signatures. From what Google tells me, a common pitfall is the use of the same random value ...
2
votes
2answers
154 views

Max size for exponent and modulus in RSA and for y, p, q, g in DSS

I'm writing a method in Java to read SSH public key in RFC 4253 format, which, in my case, can be either RSA, or DSS. What I really need is to read exponent and <...
3
votes
1answer
95 views

Appending ECDSA signature to a message

I need to authenticate a message sent to an embedded device (which limits my options in terms of just using an existing convention). I can run ECDH/ECDSA on the device and can use SHA-256 as a hash ...
4
votes
1answer
386 views

What does ChopMD refer to in the default Go ECDSA package?

If one navigates to the ECDSA Go package page, he can observe that: This implementation derives the nonce from an AES-CTR CSPRNG keyed by ChopMD(256, SHA2-512(priv.D || entropy || hash)) While I ...
3
votes
1answer
151 views

ECIES: ECDSA with Kmac and without MAC

I have couple of questions about ECIES. I understand how ECIES work and what I must do if I want to have ECIES with ECDSA for authentication (I understand that for full authentication I have to have ...
2
votes
2answers
247 views

ECIES with ECDSA

I understand how ECIES work. I have a structure of message [alice`s ephemeral public key, MAC tag, ciphertext] I do not understand what I shoud do if I want to ...
2
votes
1answer
69 views

Can ECDSA key pairs be added up or multiplied?

I have been given a public key ($y_1=x_1G$), but I don't yet know the private key ($x_1$). At a later time, I will get $x_1$ if some conditions are met. Question: Let's say I generate a new key pair ...
4
votes
1answer
713 views

What is the difference between ECDSA and EdDSA

As I understand it, both work with elliptic curves but there seems to be a difference as EdDSA is generally recommended over ECDSA.
0
votes
2answers
661 views

DSA Vulnerability in ECDSA

I have implemented a ruby code where i generate private and public keys as below. However, I read few articles [1] on DSA and why it should not be used. I'm not good at cryptography. But still ...
3
votes
0answers
84 views

Why does ECDSA transmit s and not s^-1? [duplicate]

Given: $eG=P$, $kG=(r,y)$ ECDSA signature transmits (r,s) and does this calculation: $u = \frac{z}{s}$, $v = \frac{r}{s}$ $uG+vP=(r,y)$ means the signature is valid Why do we transmit $s$ and not ...
3
votes
2answers
84 views

Private key ECDSA/TLS

Is the private key required once the certificate is hashed and signed? After a certificate is generated, public key is shared within the certificate itself. Is the private key used for any other ...