Questions tagged [dsa]

The Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. It was proposed by the National Institute of Standards and Technology (NIST) in August 1991 for use in their Digital Signature Standard (DSS), specified in FIPS 186, adopted in 1993. A minor revision was issued in 1996 as FIPS 186-1. The standard was expanded further in 2000 as FIPS 186-2 and again in 2009 as FIPS 186-3.

Filter by
Sorted by
Tagged with
0
votes
1answer
47 views

DSA - can $k$ be 1?

I'm learning DSA and I'm wondering if $k$ can be 1. I know that k has to be from $\mathbb{Z}_{q-1}$ but I don't know whether 1 is allowed (not talking about security concerns, purely educational). I ...
0
votes
0answers
38 views

In DSA digital signature, why does k have to be random and unique each for each signing? [duplicate]

If we repeat k, I think there is little chance for s to repeat since user's private key x is ...
2
votes
3answers
489 views

Why are in asymmetric cryptography as many keys as people involved needed?

The question: "10 friends wish to establish secure communications between themselves using asymmetric-key cryptography. How many keys need to be known by each user?" was posed by my teacher. He says ...
5
votes
2answers
159 views

What is TPMFail attack and what are the countermeasures?

Trusted Platform Module (TPM) is designed as a hardware-based root of trust to protect cryptographic keys even against system based adversaries. Although Intel's firmware based fTPM has FIPS 140-2 ...
0
votes
0answers
39 views

Signing with ECDSA [duplicate]

I am new to ECC. I was reading this post https://andrea.corbellini.name/2015/05/30/elliptic-curve-cryptography-ecdh-and-ecdsa/ I want to know if there is any intuition behind the following formula: $...
1
vote
1answer
54 views

Elliptic curve one time signatures

This is kind of an academic question, but I wonder if it's possible to build an intentionally one-time signature scheme with elliptic curves? I assume you could do it by supplying ECDSA with ...
3
votes
1answer
116 views

Is ECDSA signature strongly EUF-CMA?

I read, here, that ECDSA signature is EUF-CMA but not SUF-CMA, aka sEUF-CMA (for strong existential unforgeability under adaptively chosen message attacks; see terminology there). Specifically, the ...
1
vote
1answer
42 views

Is this API for ECDSA signature verification consistent with NIST test vectors?

I'm trying to use code from "Easy ECC" package (a github project), for ECDSA-verifying a signature. The problem I'm facing is that the API assumes a public key length of N+1, which is different than ...
3
votes
0answers
96 views

ECDSA signature verification checks

From Wikipedia: Check that $Q_a$ is not equal to the identity element $O$, and its coordinates are otherwise valid. Check that $Q_a$ lies on the curve. Check that $n*Q_a = O$ Verify that $r$ and $s$ ...
0
votes
1answer
53 views

ECDSA secp256k1 attacks

Are there any known and feasible ECDSA attacks on secp256k1 which can reduce the bit security of the algorithm? For example from 256 bits of security down to 192 bits?
0
votes
1answer
46 views

ECDSA public key point uniqueness [duplicate]

I'm new to ECDSA and there is something I still not sure about. If I have a classic Certificate Authority server that delivers PEM certificates containing public key with ECDSA, I can retrieve the ...
0
votes
0answers
36 views

ECDSA dA multiplication algorithm [duplicate]

I was looking at this question and i can`t understand this part: QA = dA G = 5 (5,1) = (9,16) I saw that algorithm used for this was Double-and-add algorithm but i didn't get it. Can ...
0
votes
0answers
72 views

If I have two ECDSA signatures that use the same k (nonce) but different secret keys, can the secret key be computed? [duplicate]

I have two ECDSA signatures $(r, s_1, z_1)$ and $(r, s_2, z_2)$ where $s_1 = (z_1 + r*x_1) / k$, and $s_2 = (z_2 + r*x_2) / k$. Can $x_1$ & $x_2$ be computed?
1
vote
1answer
49 views

Lookup table for DSA/ECDSA/Schnorr multiplication

Something in common to [EC]DSA and related signature schemes like Schnorr is that the most expensive part of signing is calculating $r = g^k$ in the group for some per-signature $k$ of length $b$ bits....
13
votes
2answers
882 views

Is it safe to reuse a ECDSA nonce for two signatures if the public keys are different?

We denote the s value of an ECDSA signature $(r, s)$ on a message $m$ as: $s=\frac{H(m)+xr}{k}$ Assume two ECDSA signatures sharing the same nonce $(r, s_1) , (r, s_2)$ on two messages $m_1, m_2$, ...
0
votes
1answer
65 views

Are EdDSA algorithms encoded by ASN.1 DER standards?

Is it required, or widely practiced to encode a EdDSA signature as a ASN.1 Sequence? Why or why not? How should you encode a EdDSA signature? I cannot find mention of DER or ASN in the EdDSA RFC. ...
18
votes
3answers
3k views

Digital signature that is only verifiable by one specific person

I would like to digitally sign a message in such a way that the signature can only be verified by one specific person. Simply encrypting the signature will not work, because that person could then ...
2
votes
1answer
72 views

What would happen in DSA/ECDSA if there were a collision in $r$ but not $k$?

In DSA, the value of $r$ is generated as: $r = (g^k \bmod p) \bmod q$ ECDSA is similar, using the $x$ coordinate of the generator $g$ scalar-multiplied by $k$, again taken modulo $q$. It's well-...
6
votes
1answer
198 views

Are DSA and ECDSA provably secure assuming DL security?

Is there proof that the DSA construction, also used by ECDSA, is secure assuming that discrete logarithms in the relevant group representation are difficult?
0
votes
1answer
44 views

Why create a subkey in the digital signature algorithm

In the signing step, wikipedia, a subkey is created. A key k is randomly chosen from 1..q-1. What's the use of that k? If the k is to make less exposure to the ...
1
vote
0answers
33 views

Zero Knowledge Proof of Association

Assuming there are a group of individuals with static ecdsa keypairs, of which the public keys are in a shared database that all of them have access to, how can each participant publish an ephemeral ...
1
vote
1answer
149 views

Simple math ECDSA example

I'm trying to setup an ECDSA math example using just integer math and multiply (no EC). The purpose is just to help people understand why this works with out the added complication of understanding ...
1
vote
1answer
68 views

ECDSA signature of a random 32 byte number vs. the hash of the number

I'm working on an application that involves signing a 32 byte random number generated by the OS. Assuming the RNG works as intended, is it safe to sign the random number itself rather than a hash of ...
2
votes
1answer
133 views

DSA: why using mod p mod q and not just mod p

I'd like to know, in DSA we compute several values modulo $p$ and modulo $q$, like $r = (g^k \bmod p) \bmod q$ or $v = (g^{u_1}h^{u_2} \bmod p) \bmod q$. As far as I understand, we want to use two ...
0
votes
1answer
52 views

Book request about elliptic curves, RSA and DSA

I understand that this question can be hardly downvoted, but so be it if someone gives me really useful references :) I wanna learn difference (deeply) between RSA, DSA, and ECC, especially I am ...
3
votes
1answer
180 views

ECDSA signing process

I am trying to learn how ECDSA works. I do not have a background in maths, but have been following a guide which has built me up from finite fields, elliptic curves. I am unable to figure out how a ...
3
votes
1answer
132 views

Comparison of security definitions for signatures

The two main security definitions for signatures are EUF-CMA and the strong version of it sEUF-CMA. What I see that their difference is that in EUF-CMA experiment, the adversary needs to produce a ...
4
votes
1answer
975 views

Curve25519 over Ed25519 for key exchange? Why?

I've been reading up on the Signal Protocol (in this PDF) and it seems to be using Curve25519 for ECDH and EdDSA (with Ed25519) for signatures. My question is why not use only Ed25519? This ...
4
votes
1answer
137 views

Digital Signature Algorithm (DSA) with medium fields

I understand it when we have to solve Discrete Logarithm Problem $a^x\equiv b\pmod p$, where $a$ and $b$ are given integers and we have to find secret integer $x$ that makes the equation true for some ...
0
votes
2answers
198 views

Why doesn't the formula work when checking two ECDSA signatures?

There are two generated ECDSA signatures X - Private key S = ((Z + (X * R)) / K) mod n S` = ((Z` + (X * R`)) / K`) mod n G - Base point, of order n; ...
3
votes
2answers
307 views

Which hash is used when providing signature algorithm ED25519 or ED448?

From TLS 1.3 there are two signature algorithms using edDSA: /* EdDSA algorithms */ ed25519(0x0807), ed448(0x0808), All the other signature-...
1
vote
0answers
65 views

ECDSA - why is the first part of the signature used in the second?

Using the terminology of https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm Why is the second part of the ECDSA signature defined as: $s = k^{-1}(z+rd_A)\text{ mod n}$ ...
4
votes
1answer
136 views

A missing step in ECDSA signature verification implementation

On the Wikipedia page of ECDSA, it is stated in step 6 of the verification algorithm that If (x1,y1)=O then the signature is invalid. In X9.62, it is also stated ...
1
vote
1answer
51 views

Where can I find the standard definition for GPG ECDSA signature?

I am playing around with GPG which I'd like to use to sign an integer and use the resulting signature binary in another piece of code. So far I have created a simple PGP packet parser with which I ...
1
vote
3answers
146 views

Digital Signature Algorithm for large files - bottle-necked by hash function?

I am new to studying digital signatures like ECDSA and EdDSA, and was curious about something. Lets say hypothetically I want to create a digital signatures of millions of files, with a total size of ...
6
votes
1answer
168 views

Is it important to defend against key substitution attack in ECDSA?

When planning a file signature scheme (basically, just to sign all files content). Is it obligatory to defend against ECDSA key substitution attack? ISO/IEC 14888-3:2018 NOTE 5 states: The ...
1
vote
0answers
43 views

Proof insecure DSA variant [duplicate]

Consider a variant of DSA in which the message space is $\mathbb Z_q$ and the hash function is replaced by the identity function. (So the second component of the signature is now $s := k^{−1} \...
3
votes
1answer
182 views

Security of Fast Two-Party ECDSA Signing

The paper "Fast Secure Two-Party ECDSA Signing" by Yehuda Lindell describes a system in which two parties, $P_1$ (with 1/2 of a share of a long-term ECDSA signing key $x_1$) and $P_2$ (with the other ...
1
vote
0answers
156 views

ECDSA Message Recovery from Two Encrypted Messages with Signatures and Public Key

I am currently working on a problem where I have two encrypted messages, their corresponding signatures, and the public key. Furthermore, the value of $r$ is the same in the two signatures. I am ...
1
vote
1answer
283 views

Can a TLS certificate using ECC secp384r1 as PK algorithm uses RSA for signature

If a TLS certificate public-key algorithm is ECC secp384r1 or ECC prime256v1, is it possible to have RSA as a signature ...
1
vote
1answer
2k views

What is the recommended minimum key length for ECDSA signature

I want to identify the proportion of certificates that use unrecommend ECDSA key length for TLS certificates based on some data I collected. By looking at a standard like NIST for example, I find ...
5
votes
1answer
282 views

Exactly what RNG weaknesses endanger (EC)DSA?

RFC 6979 defines deterministic variants of (EC)DSA. It states in introduction One characteristic of DSA and ECDSA is that they need to produce, for each signature generation, a fresh random ...
1
vote
1answer
138 views

openSSL and ECDSA key format inspection

If I run openssl ec on a key that I have generated with openssl ecparam -genkey I get one extra prefixing 0x00 in the private ...
6
votes
2answers
140 views

Why ECDSA has its form?

According to Wikipedia, if Alice wants to sign some message, she computes $s = k^{-1} (z + r d_A)$ then sends $(r, s)$ to Bob. I don't understand why they use this particular formula $s = k^{-1} (z + ...
1
vote
1answer
190 views

DSA signature generation [duplicate]

I am trying to implement given DSA signature generation instructions in python, there are few instructions that I couldn't understand in step 3 and 4. Let m be an arbitrary length message. The ...
1
vote
1answer
212 views

DSA: How to calculate 224-bit $q$ for 2048-bit $p$

$p$ is a 2048 bit prime number $q$ is a 224 bit prime number I know that $q$ is a prime divisor of $p-1$, thus $p=1 \bmod q$ but I couldn't write efficient code to calculate this. I can calculate ...
0
votes
1answer
275 views

ECDSA Signing and verifying signatures between Python and JS [closed]

I create a signature on js, here jsrsasign Signatures are obtained in the format: ...
2
votes
1answer
94 views

Why don't the TLS1.3 cipher suites mention the key exchange and digital signature algorithm in names?

Does it mean both RSA and ECDSA certificates can be used with the same cipher suite?
2
votes
1answer
328 views

ECDSA with common nonce?

I'm new to cryptography, and I've searching about ECDSA because I'm trying to solve a CTF. I've already check this site and Google, and I think I'm in the right path, but probably I am missing ...
0
votes
1answer
129 views

Regarding Lattice atttacks on ECDSA with a portion of known bits of the nonce k

I am new in the field of cryptography, and I am having some troubles understanding a concept regarding the lattice dimension needed in the attack on ECDSA using several messages with L known bits of ...