Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

The Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. It was proposed by the National Institute of Standards and Technology (NIST) in August 1991 for use in their Digital Signature Standard (DSS), specified in FIPS 186, adopted in 1993. ...

6
votes
1answer
210 views

Why can we not use the group $Z_{p}^{*}$ for cryptography?

Sorry if this is a noob question, but for instance in ECDSA, we start by considering the field $\mathbb F_p$, whose the elements also form a group under multiplication. Why don't we just use this ...
-2
votes
1answer
54 views

Calculating $K,N,X$ in ECDSA?

I'm confused with the parameter $n$, whether the parameter $n$ is the support point FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F or what? ...
2
votes
1answer
37 views

Can root and intermediate CAs use different asymmetric ciphers and key sizes?

For example, could a root CA use RSA-4096, one intermediate CA use RSA-2048, and another use ECDSA-256 (DH19)?
3
votes
2answers
42 views

Offline authenticated encryption for pub/sub

Requirements: only publisher can create messages publisher & subscriber can both read messages and authenticate the publisher offline message transfer messages can't be read by non-participants ...
0
votes
0answers
34 views

Why privateKey*PublicKey get different result in Ed25519 with golang [migrated]

for result, i want to calculate a value X as apiKey with formula this Pubkey1 = Privkey1 * G Pubkey2 = Privkey2 * G then we get ...
0
votes
0answers
40 views

ECDSA signature uniqueness

I've been trying to replicate an ECDSA signing process that a cryptosystem uses (EOS, in this case), and I've been having issues. Namely, testing my c++ code (which uses openSSL) and comparing the ...
4
votes
2answers
109 views

Atomic multi-party commitments

Alice and Bob publicly choose the messages $M_A$ and $M_B$ and independently sign them (Alice privately signs $M_A$, Bob signs $M_B$). Now Alice and Bob are looking for a protocol that allows them to:...
1
vote
0answers
33 views

Known risks for publishing ECDSA public keys and signatures

For an implementation of ECDSA, I'm considering the risks of publishing public keys together with multiple signatures. From what Google tells me, a common pitfall is the use of the same random value ...
2
votes
2answers
53 views

Max size for exponent and modulus in RSA and for y, p, q, g in DSS

I'm writing a method in Java to read SSH public key in RFC 4253 format, which, in my case, can be either RSA, or DSS. What I really need is to read exponent and <...
3
votes
1answer
62 views

Appending ECDSA signature to a message

I need to authenticate a message sent to an embedded device (which limits my options in terms of just using an existing convention). I can run ECDH/ECDSA on the device and can use SHA-256 as a hash ...
0
votes
0answers
35 views

Point multiplication over Fp

I have a decent grasp on how point multiplication works in the context of the regular elliptic curve, however once we limit to whole numbers over a finite field I get confused. How on the world do we ...
4
votes
1answer
209 views

What does ChopMD refer to in the default Go ECDSA package?

If one navigates to the ECDSA Go package page, he can observe that: This implementation derives the nonce from an AES-CTR CSPRNG keyed by ChopMD(256, SHA2-512(priv.D || entropy || hash)) While I ...
3
votes
1answer
87 views

ECIES: ECDSA with Kmac and without MAC

I have couple of questions about ECIES. I understand how ECIES work and what I must do if I want to have ECIES with ECDSA for authentication (I understand that for full authentication I have to have ...
2
votes
2answers
148 views

ECIES with ECDSA

I understand how ECIES work. I have a structure of message [alice`s ephemeral public key, MAC tag, ciphertext] I do not understand what I shoud do if I want to ...
2
votes
1answer
58 views

Can ECDSA key pairs be added up or multiplied?

I have been given a public key ($y_1=x_1G$), but I don't yet know the private key ($x_1$). At a later time, I will get $x_1$ if some conditions are met. Question: Let's say I generate a new key pair ...
1
vote
1answer
141 views

What is the difference between ECDSA and EdDSA

As I understand it, both work with elliptic curves but there seems to be a difference as EdDSA is generally recommended over ECDSA.
0
votes
2answers
112 views

DSA Vulnerability in ECDSA

I have implemented a ruby code where i generate private and public keys as below. However, I read few articles [1] on DSA and why it should not be used. I'm not good at cryptography. But still ...
3
votes
0answers
80 views

Why does ECDSA transmit s and not s^-1? [duplicate]

Given: $eG=P$, $kG=(r,y)$ ECDSA signature transmits (r,s) and does this calculation: $u = \frac{z}{s}$, $v = \frac{r}{s}$ $uG+vP=(r,y)$ means the signature is valid Why do we transmit $s$ and not ...
3
votes
2answers
50 views

Private key ECDSA/TLS

Is the private key required once the certificate is hashed and signed? After a certificate is generated, public key is shared within the certificate itself. Is the private key used for any other ...
1
vote
1answer
75 views

In ECDSA, why are u and v dividing by s?

The verification algorithm for ECDSA is: $P=e\times G$, $(r,y)=k\times G$, and $s=(z+re)\times k^{-1} \bmod n$, where $P$ is the public curve point, $G$ is the generator point, $e$ is the ...
1
vote
1answer
71 views

How fast a middle-class computer can verify assymetric signatures (like ECDSA, RSA etc.)?

I have an idea for a peer-to-peer network that will require every connected peer to verify many symmetric signatures per second. In bitcoin, it's the same - every peer independently verifies ...
0
votes
1answer
72 views

What is the difference between: ecdsap, ecdsak, and ecdsab in the output of “openssl speed”? What do the letters P/K/B refer to?

openssl speed tests the speed of different protocols on your computer: ...
0
votes
1answer
158 views

ECDSA vulnerability related to recovering private key using same r

I'm considering this for bitcoin transaction as it uses ECDSA so if the signer generates two signatures suppose s1 and s2. where: I get it that any attacker who have s1 and s2 can recover its private ...
1
vote
2answers
78 views

Could RSA keypairs be used for cryptocurrency addresses?

A bitcoin address is created from an ECDSA keypair. It is common to use use a hashed version of the public key as the shared address, but the original bitcoin implementation also allowed for using the ...
0
votes
1answer
88 views

ECDSA recover on arbitrary values

If I were to supply arbitrary values to an ECDSA recover function on secp256k1, is there some likelihood that the function would fail to return some value for the public key? I am specifically trying ...
1
vote
0answers
62 views

A method for creating distributed public key for ECDSA, what are the risk factors?

There is quite a bit of literature on distributed ECC signing without a trusted dealer. Published works are mostly overly complicated, so I am proposing this simple technique which I am sure if it is ...
2
votes
1answer
61 views

Which hash function to be used with DSA 2048

I'm preparing for an examination of an Information Security course at university, but I'm not sure about an explanation I created for a specific exercise. The question is: There are now DSA ...
1
vote
1answer
168 views

What is the maximum message size when using ECDSA (specifically secp256k1?

I'm guessing that the message must conform to 256 bits but I was not able to find documentation of any message length limits.
3
votes
0answers
44 views

What public-key encryption protocol can use the same key pair as ECDSA?

Assume we wanted to use the same ECDSA public/private key pair (drawn for standard ECC parameters, perhaps P-256) for both its intended use (public-key signature), and for public-key encryption; this ...
0
votes
2answers
310 views

Are ECDSA keys and RSA keys interchangeable?

Is it possible to use an ES512 key pair for RS512 signatures? Is it possible to use an RS512 key pair for ES512 signatures? I've also posted an issue in the NodeJS jwa package. I created a key pair ...
0
votes
1answer
81 views

decoding a Ed25519 key per RFC8032

RFC8032 Edwards-Curve Digital Signature Algorithm (EdDSA) 5.1.3 Decoding states the following: Decoding a point, given as a 32-octet string, is a little more complicated. First, interpret ...
1
vote
1answer
130 views

Is there a truly safe signing algorithm?

After reading this question, I'm pretty shaken up. A determined attacker with $100 in loose change can crack any RSA key in a couple of hours. After believing that these algorithms would take millions ...
5
votes
1answer
928 views

ECDSA, EdDSA and ed25519 relationship / compatibility

I'm trying to understand the relationship between those three signature schemes (ECDSA, EdDSA and ed25519) and mainly, to what degree are they mutually compatible in the sense of key pair derivation, ...
2
votes
1answer
66 views

Which one is better using DSA, or MAC and encryption?

I want to authenticate server messages to clients. The communication between clients and server is unicast. As I know I can use either used MAC or DSA. by using MAC, I required a shared key between ...
2
votes
1answer
230 views

Why do digital signatures use a hash algorithm instead of a checksum?

Based on my knowledge all digital signature algorithms use a hash function to sign a message, and then encrypt the hash result. So why do these algorithms not use a checksum instead of a hash ...
3
votes
2answers
434 views

Recovering private key from Secp256k1 signatures

I've seen many answers here and many articles that says we can recover the private key from reused R signatures. But, what if the r,s signatures are different in transaction of bitcoin then is there a ...
1
vote
0answers
31 views

Justification for the way s is computed in DSA? [duplicate]

I am sorry if this is a naive question but is there any justification for the way that s is computed in the DSA signature algorithm: $$ s = k^{-1} * (rx + m) $$ ...
0
votes
1answer
124 views

How trivial is it to derive a private key from two public keys?

It turns out that what I was attempting to do was create a form of ECDSA threshold signature protocol by just giving away multiple public keys and then having the two parties solve for the private. ...
1
vote
1answer
878 views

ECDSA Signature R|S to ASN1 DER Encoding question

I am trying to test my understanding on ECDSA Signature r|s to ASN.1 DER Encoding for NIST P-256. I have r|s and when I convert ...
1
vote
1answer
50 views

Requirements for attacker-controlled ECDSA identity point signature

Wikipedia's description of the ECDSA verification algorithm suggests verifiers should confirm that step 6 doesn't produce the identity point: Calculate the curve point ${(x_{1},y_{1})=u_{1}G + u_{...
1
vote
1answer
264 views

Will the ECDSA with SHA-3 implementation be quantum-proof?

I know, that ECDSA could be broken by quantum computers, but since there is post-quantum hash function SHA-3, does not this make the digital signature resistant to them?
2
votes
1answer
60 views

DSA signature computation

Reading through the DSA signature specification, one thing stood out for me. $r = (g^k \bmod{p} ) \bmod{q}$ Then $s$ is computed. In the computation above, why is the modulo $p$ required, given we ...
2
votes
1answer
150 views

Can Montgomery ladder multiplication be used with secp256k1?

Reading about elliptical curves and ECDSA, I found a paper 'ECDSA Security in Bitcoin and Ethereum: a Research Survey' by Hartwig Mayer. On page 6, the authors say: ...
0
votes
1answer
161 views

What kind of ECDSA signature encoding is this?

I am trying to generate an ECDSA signature using ARM's CryptoCell 310 (hardware cryptography module) and verify the signature using mbedTLS software library. The harware module documentation says ...
1
vote
1answer
36 views

Does the XML signature standard support Ed25519?

https://www.w3.org/2008/xmlsec/Drafts/xmldsig-core-20/#sec-ECKeyValue talks about ECDSA but even the explicit curve parameter stuff won't work with Ed25519 as Ed25519 has a completely different ...
1
vote
1answer
202 views

Is there any ECDSA Attack if I have millions of signatures?

I have been given the task to test the security of our company software. Our company software generates ecdsa signed supply order files. One can generate as many files as he wants. so my question is ...
1
vote
0answers
29 views

Is integrity important when building anonymity?

I was thinking about applying an anonymity process based on ECDSA signatures to anonymize blocks of information, not the public-key itself. Using a deterministic form of ECDSA to sign blocks and ...
3
votes
1answer
108 views

Does an adversary require the public key to perform operations when RSA or ECC is broken?

If we had a way to break signature or encryption schemes (e.g. recover the key, recover plaintexts from ciphertexts, forge signatures), e.g. a quantum computer that was powerful enough to break ...
0
votes
1answer
165 views

How to convert ECDSA P256 curve signature to SECP256K1 curve?

I would like to get the ATECC608A microchip to sign data with ECDSA secp256k1 curve, but the chip only signs using the P256 curve. Is there an operation I can do using the original message and the ...
3
votes
1answer
55 views

should one worry about timing attacks with signature verification?

To compare two varablies in such a way that timing attacks don't exist it's generally recommended you pad the strings to the same length and then look at each byte, even if an earlier byte was ...