Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

The Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. It was proposed by the National Institute of Standards and Technology (NIST) in August 1991 for use in their Digital Signature Standard (DSS), specified in FIPS 186, adopted in 1993. ...

-2
votes
0answers
53 views

i can know if any unknown ECDSA point is (odd or even) !! , But

This video show how i can know if the point is odd or even, https://www.youtube.com/watch?v=iux7to1iNlw I use same bitcoin curve, but i changed the n mod number, This is my C# code, ...
0
votes
1answer
52 views

Regarding Lattice atttacks on ECDSA with a portion of known bits of the nonce k

I am new in the field of cryptography, and I am having some troubles understanding a concept regarding the lattice dimension needed in the attack on ECDSA using several messages with L known bits of ...
2
votes
1answer
69 views

Encrypt your ECDSA signature with NTRU to make them quantum secure, does that work?

I have a general question about quantum security. ECDSA is suppose to be broken by quantum computers. Whilst something like NTRU is suppose to be secure. My question is: if we sign with ECDSA and ...
1
vote
0answers
25 views

Linkable ECDSA like signature

In our process of digital checks for banking - which needs to work online and offline - the receiver needs to know the chain of all generated signatures without consulting an Internet service. In this ...
0
votes
2answers
52 views

ecdsa where the group order is larger than the hash size?

According to wikipedia, when generating a signature for ECDSA, you do the following (among other things): Calculate $e=HASH(m)$, where $HASH$ is a cryptographic hash function, such as SHA-2. ...
1
vote
0answers
31 views

How to prove two ECDSA public keys on two different curves are generated from the same private key [duplicate]

I wonder if I provide someone with two public keys from different elliptic curves, is there any way to prove that these two public keys are generated from the same private key without revealing the ...
0
votes
0answers
21 views

Are the cryptographic primitives of ZKPs more closely related to an encryption scheme or to a DSA?

I've read about how the Fiat-Shamir heuristic has been used to construct Non-Interactive Zero Knowledge Proof systems, Schnorr signatures, and encryption schemes. From my understanding, the ...
6
votes
1answer
257 views

Why can we not use the group $Z_{p}^{*}$ for cryptography?

Sorry if this is a noob question, but for instance in ECDSA, we start by considering the field $\mathbb F_p$, whose the elements also form a group under multiplication. Why don't we just use this ...
-2
votes
1answer
64 views

Calculating $K,N,X$ in ECDSA?

I'm confused with the parameter $n$, whether the parameter $n$ is the support point FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F or what? ...
2
votes
1answer
46 views

Can root and intermediate CAs use different asymmetric ciphers and key sizes?

For example, could a root CA use RSA-4096, one intermediate CA use RSA-2048, and another use ECDSA-256 (DH19)?
3
votes
2answers
45 views

Offline authenticated encryption for pub/sub

Requirements: only publisher can create messages publisher & subscriber can both read messages and authenticate the publisher offline message transfer messages can't be read by non-participants ...
-1
votes
0answers
95 views

ECDSA signature uniqueness

I've been trying to replicate an ECDSA signing process that a cryptosystem uses (EOS, in this case), and I've been having issues. Namely, testing my c++ code (which uses openSSL) and comparing the ...
4
votes
2answers
118 views

Atomic multi-party commitments

Alice and Bob publicly choose the messages $M_A$ and $M_B$ and independently sign them (Alice privately signs $M_A$, Bob signs $M_B$). Now Alice and Bob are looking for a protocol that allows them to:...
1
vote
0answers
38 views

Known risks for publishing ECDSA public keys and signatures

For an implementation of ECDSA, I'm considering the risks of publishing public keys together with multiple signatures. From what Google tells me, a common pitfall is the use of the same random value ...
2
votes
2answers
84 views

Max size for exponent and modulus in RSA and for y, p, q, g in DSS

I'm writing a method in Java to read SSH public key in RFC 4253 format, which, in my case, can be either RSA, or DSS. What I really need is to read exponent and <...
3
votes
1answer
76 views

Appending ECDSA signature to a message

I need to authenticate a message sent to an embedded device (which limits my options in terms of just using an existing convention). I can run ECDH/ECDSA on the device and can use SHA-256 as a hash ...
0
votes
0answers
38 views

Point multiplication over Fp

I have a decent grasp on how point multiplication works in the context of the regular elliptic curve, however once we limit to whole numbers over a finite field I get confused. How on the world do we ...
4
votes
1answer
257 views

What does ChopMD refer to in the default Go ECDSA package?

If one navigates to the ECDSA Go package page, he can observe that: This implementation derives the nonce from an AES-CTR CSPRNG keyed by ChopMD(256, SHA2-512(priv.D || entropy || hash)) While I ...
3
votes
1answer
93 views

ECIES: ECDSA with Kmac and without MAC

I have couple of questions about ECIES. I understand how ECIES work and what I must do if I want to have ECIES with ECDSA for authentication (I understand that for full authentication I have to have ...
2
votes
2answers
166 views

ECIES with ECDSA

I understand how ECIES work. I have a structure of message [alice`s ephemeral public key, MAC tag, ciphertext] I do not understand what I shoud do if I want to ...
2
votes
1answer
60 views

Can ECDSA key pairs be added up or multiplied?

I have been given a public key ($y_1=x_1G$), but I don't yet know the private key ($x_1$). At a later time, I will get $x_1$ if some conditions are met. Question: Let's say I generate a new key pair ...
2
votes
1answer
241 views

What is the difference between ECDSA and EdDSA

As I understand it, both work with elliptic curves but there seems to be a difference as EdDSA is generally recommended over ECDSA.
0
votes
2answers
207 views

DSA Vulnerability in ECDSA

I have implemented a ruby code where i generate private and public keys as below. However, I read few articles [1] on DSA and why it should not be used. I'm not good at cryptography. But still ...
3
votes
0answers
81 views

Why does ECDSA transmit s and not s^-1? [duplicate]

Given: $eG=P$, $kG=(r,y)$ ECDSA signature transmits (r,s) and does this calculation: $u = \frac{z}{s}$, $v = \frac{r}{s}$ $uG+vP=(r,y)$ means the signature is valid Why do we transmit $s$ and not ...
3
votes
2answers
63 views

Private key ECDSA/TLS

Is the private key required once the certificate is hashed and signed? After a certificate is generated, public key is shared within the certificate itself. Is the private key used for any other ...
1
vote
1answer
93 views

In ECDSA, why are u and v dividing by s?

The verification algorithm for ECDSA is: $P=e\times G$, $(r,y)=k\times G$, and $s=(z+re)\times k^{-1} \bmod n$, where $P$ is the public curve point, $G$ is the generator point, $e$ is the ...
1
vote
1answer
115 views

How fast a middle-class computer can verify assymetric signatures (like ECDSA, RSA etc.)?

I have an idea for a peer-to-peer network that will require every connected peer to verify many symmetric signatures per second. In bitcoin, it's the same - every peer independently verifies ...
0
votes
1answer
86 views

What is the difference between: ecdsap, ecdsak, and ecdsab in the output of “openssl speed”? What do the letters P/K/B refer to?

openssl speed tests the speed of different protocols on your computer: ...
0
votes
1answer
213 views

ECDSA vulnerability related to recovering private key using same r

I'm considering this for bitcoin transaction as it uses ECDSA so if the signer generates two signatures suppose s1 and s2. where: I get it that any attacker who have s1 and s2 can recover its private ...
1
vote
2answers
120 views

Could RSA keypairs be used for cryptocurrency addresses?

A bitcoin address is created from an ECDSA keypair. It is common to use use a hashed version of the public key as the shared address, but the original bitcoin implementation also allowed for using the ...
0
votes
1answer
134 views

ECDSA recover on arbitrary values

If I were to supply arbitrary values to an ECDSA recover function on secp256k1, is there some likelihood that the function would fail to return some value for the public key? I am specifically trying ...
1
vote
0answers
78 views

A method for creating distributed public key for ECDSA, what are the risk factors?

There is quite a bit of literature on distributed ECC signing without a trusted dealer. Published works are mostly overly complicated, so I am proposing this simple technique which I am sure if it is ...
2
votes
1answer
93 views

Which hash function to be used with DSA 2048

I'm preparing for an examination of an Information Security course at university, but I'm not sure about an explanation I created for a specific exercise. The question is: There are now DSA ...
1
vote
1answer
236 views

What is the maximum message size when using ECDSA (specifically secp256k1?

I'm guessing that the message must conform to 256 bits but I was not able to find documentation of any message length limits.
3
votes
0answers
45 views

What public-key encryption protocol can use the same key pair as ECDSA?

Assume we wanted to use the same ECDSA public/private key pair (drawn for standard ECC parameters, perhaps P-256) for both its intended use (public-key signature), and for public-key encryption; this ...
1
vote
2answers
527 views

Are ECDSA keys and RSA keys interchangeable?

Is it possible to use an ES512 key pair for RS512 signatures? Is it possible to use an RS512 key pair for ES512 signatures? I've also posted an issue in the NodeJS jwa package. I created a key pair ...
0
votes
1answer
112 views

decoding a Ed25519 key per RFC8032

RFC8032 Edwards-Curve Digital Signature Algorithm (EdDSA) 5.1.3 Decoding states the following: Decoding a point, given as a 32-octet string, is a little more complicated. First, interpret ...
1
vote
1answer
158 views

Is there a truly safe signing algorithm?

After reading this question, I'm pretty shaken up. A determined attacker with $100 in loose change can crack any RSA key in a couple of hours. After believing that these algorithms would take millions ...
9
votes
1answer
2k views

ECDSA, EdDSA and ed25519 relationship / compatibility

I'm trying to understand the relationship between those three signature schemes (ECDSA, EdDSA and ed25519) and mainly, to what degree are they mutually compatible in the sense of key pair derivation, ...
2
votes
1answer
80 views

Which one is better using DSA, or MAC and encryption?

I want to authenticate server messages to clients. The communication between clients and server is unicast. As I know I can use either used MAC or DSA. by using MAC, I required a shared key between ...
2
votes
1answer
381 views

Why do digital signatures use a hash algorithm instead of a checksum?

Based on my knowledge all digital signature algorithms use a hash function to sign a message, and then encrypt the hash result. So why do these algorithms not use a checksum instead of a hash ...
3
votes
2answers
556 views

Recovering private key from Secp256k1 signatures

I've seen many answers here and many articles that says we can recover the private key from reused R signatures. But, what if the r,s signatures are different in transaction of bitcoin then is there a ...
1
vote
0answers
34 views

Justification for the way s is computed in DSA? [duplicate]

I am sorry if this is a naive question but is there any justification for the way that s is computed in the DSA signature algorithm: $$ s = k^{-1} * (rx + m) $$ ...
0
votes
1answer
155 views

How trivial is it to derive a private key from two public keys?

It turns out that what I was attempting to do was create a form of ECDSA threshold signature protocol by just giving away multiple public keys and then having the two parties solve for the private. ...
1
vote
1answer
2k views

ECDSA Signature R|S to ASN1 DER Encoding question

I am trying to test my understanding on ECDSA Signature r|s to ASN.1 DER Encoding for NIST P-256. I have r|s and when I convert ...
1
vote
1answer
52 views

Requirements for attacker-controlled ECDSA identity point signature

Wikipedia's description of the ECDSA verification algorithm suggests verifiers should confirm that step 6 doesn't produce the identity point: Calculate the curve point ${(x_{1},y_{1})=u_{1}G + u_{...
1
vote
1answer
295 views

Will the ECDSA with SHA-3 implementation be quantum-proof?

I know, that ECDSA could be broken by quantum computers, but since there is post-quantum hash function SHA-3, does not this make the digital signature resistant to them?
2
votes
1answer
70 views

DSA signature computation

Reading through the DSA signature specification, one thing stood out for me. $r = (g^k \bmod{p} ) \bmod{q}$ Then $s$ is computed. In the computation above, why is the modulo $p$ required, given we ...
2
votes
1answer
210 views

Can Montgomery ladder multiplication be used with secp256k1?

Reading about elliptical curves and ECDSA, I found a paper 'ECDSA Security in Bitcoin and Ethereum: a Research Survey' by Hartwig Mayer. On page 6, the authors say: ...
0
votes
1answer
258 views

What kind of ECDSA signature encoding is this?

I am trying to generate an ECDSA signature using ARM's CryptoCell 310 (hardware cryptography module) and verify the signature using mbedTLS software library. The harware module documentation says ...