Questions tagged [dsa]
The Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. It was proposed by the National Institute of Standards and Technology (NIST) in August 1991 for use in their Digital Signature Standard (DSS), specified in FIPS 186, adopted in 1993. A minor revision was issued in 1996 as FIPS 186-1. The standard was expanded further in 2000 as FIPS 186-2 and again in 2009 as FIPS 186-3.
484
questions
1
vote
1
answer
35
views
Recovering the curve-point R from a signature ECDSA
When recovering the public key from ECDSA signature (r, s), the first step is recovering the point R.
You do this by plugging in (r + xn) into the curve equation where n is the order of the basepoint ...
- 11
2
votes
1
answer
157
views
Why must ECDSA verification ensure the point is on the curve?
In ECDSA, when parsing the public key a test is made to ensure the public key really lies on the curve. What vulnerabilities appear if one does not do this?
- 51
2
votes
0
answers
49
views
Forging an ECDSA signature for a random public key string
An adversary is able to insert a random string (which he does not control: he can only randomly generate it and insert it). The random string is parsed by the victim as an ECDSA public key. This ...
- 51
2
votes
1
answer
96
views
What degree of k bias is acceptable in ECDSA?
So there’s LadderLeak.
RFC6979 produces uniformly random nonce $k$.
There are other techniques, such as hash-to-curve standard (draft-irtf-cfrg-hash-to-curve-16 section 5), which allows to produce ...
- 291
0
votes
0
answers
19
views
Digital Signature Algorithm(DSA) without hashing the message? [duplicate]
I am learning about various digital signatures and came across DSA. In DSA, the $s$ part of the signature has a hash of the message $H(m)$. I was wondering, why can't we just use the message $m$ ...
1
vote
1
answer
203
views
ECDSA SECP256k1 curve - same-r-value-is-used-for-two-different-addresses
Edited: changing the notation according request by fgrieu.
I have prepared 4 transactions for 2 pubkeys with the same r1 and r2.
properties of secp256k1:
...
- 11
2
votes
1
answer
60
views
ECDSA-SHA256 HTTP Signature String Construction
I must verify an HTTP signature to guarantee the origin and integrity of a webhook data: https://www.blockcypher.com/dev/bitcoin/#webhook-signing
This is their x509 PKIX encoded signing key's public ...
- 33
1
vote
0
answers
39
views
Verifying ECDSA-SHA256 HTTP Signature [duplicate]
With PHP, I'm trying to setup a HTTP signature verification for webhook requests coming from BlockCypher: https://www.blockcypher.com/dev/bitcoin/?php#webhook-signing
This is their public key: ...
- 33
1
vote
1
answer
37
views
Can a quantum attacker prove that incomplete ECDSA signatures were produced with the same key?
Assume a 256-bit ECDSA private key used with Secp256k1 and SHA-256. This key signs multiple different messages in a fully deterministic manner as described in RFC-6979, so signing the same message ...
- 43
3
votes
2
answers
97
views
Given multiple incomplete ECDSA signatures, what can a quantum attacker learn in the following scenarios?
Assume a 256-bit ECDSA private key used with Secp256k1 and SHA-256. This key signs multiple different messages in a fully deterministic manner as described in RFC-6979, so signing the same message ...
- 43
2
votes
0
answers
25
views
Fusion auth versus jose4j library for jwt using secp256k [closed]
I am a beginner in-terms of JWT libraries in programming.
How the keypair used (secp256k1) is related with the algorithmic header used for creation of JWT?
And why authfusion doesn't need an ...
- 21
3
votes
3
answers
1k
views
How can we reverse Elliptic Curves after solving the DLP problem?
Suppose that I've solved the Discrete Logarithm problem. Can someone explain to me in terms of the example below how to arrange values of Elliptic Curve secp256k1 in a reverse form so that I can ...
0
votes
1
answer
115
views
Solve discrete logarithm with new chinese research
Does this research also work for breaking bitcoin ECDSA? If so, how many qubit will be needed for 256-bit elliptic curve key?
user106244
2
votes
0
answers
71
views
Could classical computers end up breaking the ECDLP through prime factorization (GNFS)?
Is there any way in which classical computers oculd end up breaking ECDLP. I read that GNFS could through prime factorization, but I am not sure if I understood this properly.
- 51
3
votes
2
answers
275
views
How could ECDSA be broken with prime factorization through Shor's Algorithm?
could anyone help me understand how is ECDSA broken using Shor's Algorithm? All the papers I find are too complex to understand, and even though I feel I understand some concepts, some others are a ...
- 51
1
vote
0
answers
40
views
ECDSA security proof in random oracle
I need to know if there is a security proof for ECDSA in the Random Oracle model?
- 51
1
vote
2
answers
217
views
Convert a Schnorr Public Key to a compressed ECDSA Public Key
Given a Schnorr Public Key (32 bytes) x, I'd like to generate a compressed ECDSA Public Key (33 bytes) and thus be able to generate the bitcoin address that the private key holder can generate with ...
- 29
2
votes
1
answer
71
views
Is a single digital signature (ECDSA) of an encryption key (AES) enough to verify the legitimacy of all encrypted messages?
I have an encryption scheme set up with a client and server that utilizes AES 256. What I am curious about is whether or not all information sent from the server to the client can be verified as ...
1
vote
1
answer
47
views
Mod operation while verifying an ECDSA signature with SECT233R1
I'm trying to perform ECDSA verification in hardware. I'm using the SECT233R1 curve (NIST B-233). I have a question about the hash function used while doing so.
I want to use the SHA256 hash function ...
2
votes
0
answers
203
views
ECDSA Common Nonce Reuse Attack
so I recently stumbled upon this video by @bertcmiller who created two transactions with the same nonce "k". That seen I researched quite a lot of pages explaining how to recover the private ...
- 21
2
votes
0
answers
56
views
What is the advantage of ECDSA over Schnorr signature?
As we know, the Schnorr signature enjoys the linearity property, which does not exist in ECDSA. It seems the Schnorr signature is more efficient and can bring more features than ECDSA. What is the ...
- 777
2
votes
1
answer
215
views
Create a new signature from existing DSA signatures
Is it possible to generate a new valid signature for some arbitrary message using DSA if we know existing signatures for the same message? We are an adversary, therefore we do not hold the private key,...
- 21
1
vote
1
answer
266
views
How to know if a public key has been created based on the ECDSA algorithm?
Suppose in a network, the identity of users is their public key, which is generated based on the ECDSA algorithm. That is, to create a valid identity, a user must generate an ECDSA public key and then ...
- 211
1
vote
2
answers
421
views
Recovering nonce in ECDSA with known shared components in ECDSA
This is a slight variation of the shared nonce problem. We do have a lot more shared information between two nonces.
Given a random $k$:
$$
k_1 = ka,
k_2 = kb
$$
I am now signing two messages, which ...
- 111
0
votes
1
answer
81
views
Is it impossible to extract any data from an ECDSA signature of hashed data
I am trying to write a function that, given an EIP712 ECDSA signature, verifies the signature was signed by a particular person, and then (somehow) retrieves the information that is encoded in the ...
- 103
3
votes
1
answer
143
views
Does ECDSA leak information about the message hash?
ECDSA works by computing the hash of a message and then computing the signature for it. ECDSA uses the signature:
$$s = k^{-1}(h + rp_{pr})\,\textrm{mod } n,$$
where $n$ is the order of the group, $k$ ...
- 131
5
votes
1
answer
96
views
Consequence of improper validation in point decompression?
Assume a standard ECC curve in a prime field $\mathbb F_p$ with $p\equiv3\pmod 4$, such as secp256k1; and code turning a bytestring for a compressed ECC public key into an Elliptic Curve point, that ...
- 132k
0
votes
1
answer
42
views
Can there be different private keys for the same public key in DSA?
From the Wikipedia page for DSA(Digital Signature Algorithm) we have the following private/public key generation:
Choose an integer x randomly from [1, q-1]
Compute y := g^x mod p
x is the private ...
4
votes
1
answer
349
views
Is a padded 128 bit private key enough for ecdsa 256?
According to the following, ecdsa-256 only provides ~128 bit security even for 256 bit private key:
A multi-target attack on 128-bit ECDSA private keys
If the private key has only 128 bit entropy but ...
- 143
1
vote
0
answers
72
views
Using a signature as key material
I am designing my first web3 app and I would like to use MetaMask as an identity and crypto provider. My web3 app will encrypt user data with AES-GCM, but I do not want to generate and store an ...
- 11
1
vote
1
answer
83
views
Non-determnistic ECDSA: is there any unique common factor of all signatures of the same message by the same private key?
For non-deterministic ECDSA:
Given message $m$ and private key $p$, produce a series of signatures $s_i = signature(p,m)$, $i=[1,n]$.
Does there exist some function $f$ such that $j_i=f(s_i)$ and $j_1=...
- 113
3
votes
1
answer
286
views
What's the problem with ECDSA and SHA-3?
To quote Ilari on the CFRG mailing list:
e.g. the vile mess that is ECDSA with SHA-3
I have some ideas what he might mean but I couldn't find the discussion so what is that mess?
- 4,883
0
votes
1
answer
240
views
Difference between DSA and RSA in terms of signature generation
For DSA, if the same message is signed multiple times on different occasions, the signatures will differ because the random value k is generated for each signature. This is not true of RSA signatures....
- 159
2
votes
2
answers
340
views
Are digital signatures unique for the messages they sign?
Practical implementations of digital signature algorithms (DSAs) employ hash functions to ensure that input is small and of a fixed sized; otherwise, DSAs would be too slow for most real-world ...
1
vote
1
answer
947
views
Can OpenSSL sign an ED25519 certificate with ECDSA-with-SHA256?
We are trying to generate some self-signed certificates to test our cybersecurity firmware before switching to a "real" CA-signed chain of trust. The specification we are coding to mandates ...
- 111
2
votes
2
answers
201
views
Security Level of DSA given parameters
So I'm trying to compare different digital signatures, and thus I stumbled upon a DSA algorithm. I'm using python's cryptography library, and it offers following values for L and N:
L=1024,N=160
L=...
- 43
2
votes
1
answer
143
views
ASN.1 integer question for DSA
I'm trying to implement own DSA signature check as per guide at this site page 20 in python.
...
1
vote
1
answer
83
views
Working with Paillier and ECDSA - Order issue
I'm trying to implement two party computation for ECDSA signing using Paillier cryptosystem.
But my problem is that the order of Paillier is different from the order of the curve (secp256k1 in my case)...
- 123
1
vote
1
answer
53
views
Secure modification of DSA?
In DSA, we compute the signature $(r,s)$ on $m$ by sampling $k\in\{1,...,q-1\}$ and then computing
$r := g^k \bmod p$
$s := k^{-1}*(m+x*r) \bmod q$
During verification, we compute $v:=g^{m*s^{-1}}*y^{...
- 519
0
votes
0
answers
562
views
ECDSA private key recovery
I have a bunch of signatures (1000) signed with ECDSA secp256k1 curve. I can verify all of them with the same public key.
I have studied attacks are performed against ECDSA signatures using known MSB ...
0
votes
0
answers
41
views
Consider the DSA digital signature scheme. Does the intercepted message m||s||r contain all information about the signer’s private key?
Consider the DSA digital signature scheme.
Does the intercepted message m||s||r contain all information about the signer’s private key? Please justify your answer carefully.
Please note that the ...
- 1
1
vote
0
answers
177
views
What data can be derived from ECDSA signature and message?
I generate a random message m sent to a device that calculates sig(m, privKey) with secp256k1...
- 11
3
votes
1
answer
410
views
Strauss-Shamir trick on EC multiplication by scalar
I'm studying ECDSA, and almost all somewhat detailed articles talk about using Strauss-Shamir trick on the verification step.
Then I searched, and found this explanation (more like a stating) for the ...
- 195
3
votes
1
answer
329
views
Is it theoretically possible to delegate public key generation?
Imagine the following scenario:
In a given cryptocurrency, privacy should be as high as possible.
For this purpose, a new account with a new address is created for every incoming transaction (the ...
2
votes
1
answer
223
views
Why is r used in ECDSA signature while R in Schnorr signature?
In Schnorr signature (R, s), R is used. But in ECDSA signature (r, s), r is used, which is the x-coordinate of R. Why the difference?
- 145
2
votes
1
answer
397
views
Can I generate two similar ECDSA public keys?
I am using a system that relies on base64 encoded ECDSA public keys.
I have managed to brute-force a public key that when encoded starts with a word I like.
Is it possible for me, given the private ...
- 23
1
vote
1
answer
89
views
MAC vs MDC when using ECDH+ECDSA in OpenPGP
I intend to design a model to comply with RFC4880.
According to RFC6637, ECC in OpenPGP
+ECDSA to sign message
+ECDH + KeyWrap for session key encryption
-MAC: is used for key confirmation (with C(1e, ...
- 51
2
votes
1
answer
241
views
Is DSA still secure without the factor "r"?
If I understand correctly, the way DSA in a group $G$ with a hash function $H$ works is: Peggy (signer) has a private/public key pair $x$, $g^x$. For signing, she produces a random session key $k$, $g^...
- 23
1
vote
1
answer
93
views
Is f(G) uniform under the described condition in ECDSA?
In ECDSA, $f(G)=r$, where $r$ is the $𝑥$-coordinate of group element $G$. Now it is known that $f(G)$ is not uniform(Why isn't $f(G)$ uniform in ECDSA?). Then in which range $f(G)$ is uniform?
Let $\...
- 777
1
vote
1
answer
361
views
Shor's algorithm and ECDSA in Bitcoin - why is finding the private key still difficult when we know the base point?
I'm learning about Shor's algorithm and how it can be applied to break ECDSA. I've clearly missed something basic here - I thought I understood that the challenge ECDSA presented was to find the ...
- 13