Questions tagged [dsa]

The Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. It was proposed by the National Institute of Standards and Technology (NIST) in August 1991 for use in their Digital Signature Standard (DSS), specified in FIPS 186, adopted in 1993. A minor revision was issued in 1996 as FIPS 186-1. The standard was expanded further in 2000 as FIPS 186-2 and again in 2009 as FIPS 186-3.

Filter by
Sorted by
Tagged with
9 votes
1 answer
18k views

What is the recommended minimum key length for ECDSA signature

I want to identify the proportion of certificates that use unrecommend ECDSA key length for TLS certificates based on some data I collected. By looking at a standard like NIST for example, I find ...
3 votes
1 answer
473 views

What's the problem with ECDSA and SHA-3?

To quote Ilari on the CFRG mailing list: e.g. the vile mess that is ECDSA with SHA-3 I have some ideas what he might mean but I couldn't find the discussion so what is that mess?
0 votes
0 answers
34 views

Proof that the DSA ID scheme is secure

I want to prove that the DSA identification scheme is secure and orientated me at the proof that Schnorr ID scheme is secure. In the book "Introduction to Modern Cryptography" by Katz, ...
3 votes
0 answers
159 views

Prove DSA signature scheme is EUF-CMA secure

I want to prove that the DSA signature scheme is EUF-CMA secure in the random oracle model, if the discrete logarithm problem is hard. I know it can be proved by the following two parts: Discrete ...
3 votes
0 answers
61 views

Is it fine to use ECDSA with edwards25519?

The elliptic.js library allows instantiating ECDSA with the edwards25519 curve. I've rarely seen this combination in the wild. ...
0 votes
0 answers
28 views

P256 signature verification was succeed with 2 public key [duplicate]

I tried to recover public key from P256 signature. With 2 recovery id ( 0, 1 ), signature makes 2 public key. And I tried to verify signature with public key and verification was succeed all of 2 keys....
1 vote
0 answers
52 views

Using Deterministic ECDSA (secp256k1) Signature as a Cipher Key in Symmetric Encryption

I'm exploring the security implications of utilizing a deterministic ECDSA signature as a cipher key for symmetric encryption and would appreciate insights from the community. Here's the setup I'm ...
2 votes
0 answers
46 views

threshold signature scheme that allows adding and removing members

Is there a threshold signature scheme (TSS) that a quorum in a group can sign, where members can dynamically join and leave, without changing the shared group public key? ECDSA, BLS, and Schnorr based ...
1 vote
0 answers
112 views

ECDSA: Can we use the private key for a different curve? [closed]

ECDSA can be instantiated with a variety of different elliptic curve groups. Two example curves are secp256k1 and edwards25519. ...
3 votes
1 answer
2k views

Can Montgomery ladder multiplication be used with secp256k1?

While reading about Elliptical Curves and ECDSA, I found a paper ECDSA Security in Bitcoin and Ethereum: a Research Survey by Hartwig Mayer. On page 6, the authors say: The curve secp256k1 does not ...
2 votes
2 answers
339 views

ECDSA-SHA256 HTTP Signature String Construction

I must verify an HTTP signature to guarantee the origin and integrity of a webhook data: https://www.blockcypher.com/dev/bitcoin/#webhook-signing This is their x509 PKIX encoded signing key's public ...
4 votes
0 answers
178 views

Split a private key into shares and sign successively or separately

Assume I have a private key, priv_k, a public key pub_key and a message, msg, along with its ...
3 votes
1 answer
79 views

Why are there two Challenges in the DSA Identification Scheme?

Would either $\alpha$ or $r$ suffice as challenge? I am aware that the signature and verification were to adapt. However, what is the motivation behind using two challenges?
19 votes
2 answers
12k views

Difference between X25519 vs. Ed25519

I am reading https://en.wikipedia.org/wiki/Curve25519 and it states Also in 2018, RFC 8446 was published as the new Transport Layer Security v1.3 standard. It requires mandatory support for X25519, ...
1 vote
1 answer
108 views

Understanding the Communication Protocol of Apple HomeKey

I am currently analyzing the communication protocol of HomeKey. Here are two traces between the lock (reader) and the device (card). First set: ...
0 votes
0 answers
46 views

DSA using same k value, recover secret

I have two signatures $(r,s)$ and $(r,s')$. So the same $k$ is being used for generating the $r$ value. I know that this exposes a vulnerability such that I can recover the secret $x$. The first step ...
1 vote
1 answer
123 views

Working with Paillier and ECDSA - Order issue

I'm trying to implement two party computation for ECDSA signing using Paillier cryptosystem. But my problem is that the order of Paillier is different from the order of the curve (secp256k1 in my case)...
3 votes
2 answers
338 views

Security Level of DSA given parameters

So I'm trying to compare different digital signatures, and thus I stumbled upon a DSA algorithm. I'm using python's cryptography library, and it offers following values for L and N: L=1024,N=160 L=...
3 votes
0 answers
136 views

EC public key with leading zeros

Let us take example of secp256k1 curve. The current known public key with most leading zero (in x cordinate) is: ...
3 votes
1 answer
1k views

Why do we need additional secret value (k) in ECDSA?

Formula for calculating an ECDSA signature (r, s) is: s = k-1(z + qr) k - private key for a random point R z - hash of a message q - original private key r - x(R) I am interested in why do we need ...
6 votes
2 answers
2k views

Are curve secp256k1 ECDSA signatures distinguishable from random data?

Are the 64-byte curve secp256k1 ECDSA signatures distinguishable from random data? I.e. Given a random private key and random data, will there be patterns? Is there a proof or reasoning for this?
4 votes
1 answer
361 views

Does ECDSA leak information about the message hash?

ECDSA works by computing the hash of a message and then computing the signature for it. ECDSA uses the signature: $$s = k^{-1}(h + rp_{pr})\,\textrm{mod } n,$$ where $n$ is the order of the group, $k$ ...
1 vote
0 answers
41 views

Where do we put known bits of nonce when performing lattice attack on ECDSA?

I have read so many papers and posts about lattice attacks on ECDSA but none of them used an example of different MSB values for k but instead they all used fixed MSB. So here i am trying to ...
42 votes
2 answers
27k views

How does recovering the public key from an ECDSA signature work?

It is possible to recover the public key from an ECDSA signature values $(r,s)$? Please explain how this works.
0 votes
0 answers
32 views

Three ECDSA signatures sharing first component r, verifying against same message and public key?

For some common curve, can we exhibit three distinct ECDSA signatures $(r,s_1)$, $(r,s_2)$, $(r,s_3)$, a message $m$, and valid public key $Q$, such that the signatures verify? Can we also generate ...
1 vote
2 answers
131 views

Can ECDSA be broken if same nonce is used with the same message?

I have a scenario where $k_2 = -k_1$ while $z_1$ and $z_2$ are identical but the values $s_1$ and $s_2$ are different. So we have $r_1 = r_2$ and $z_1 = z_2$ but $s_1 \neq s_2$. Does this mean an ...
6 votes
4 answers
1k views

Why R value in signatures have to be 'calculated' values and not just a random numbers?

This document (page 27) says that: The only significant difference between ECDSA and DSA is in the generation of $r$. ECDSA $r = (kG)_x \bmod n$ and, DSA: $r=g^k \bmod p$ Why is it necessary to ...
3 votes
1 answer
103 views

Differences between the theory and implementation of a lattice attack against ECDSA

I know the theory of lattice attacks against ECDSA from Minerva. So, as far as I can understand, the lattice that they build is $$ L_M = \begin{bmatrix} 2^ln & 0 & 0 & \cdots & 0 & ...
0 votes
0 answers
45 views

Is this ECDSA's protection mechanism or something wrong with it?

Over the past few months, I have been reading and trying to understand how ECDSA works and how safe is it. So now something does not add up between its signature verification and generation. But maybe ...
0 votes
0 answers
53 views

Framework for manipulating digital signatures

for a research project, i am currently looking for a way to manipulate the digital signature of a HTTPS TLS message flow. More specifically, i am trying to create a working example for a malicious ...
1 vote
0 answers
74 views

Can lattice attack work MSB or LSB are unkown but 16 bytes of private key are known?

I have been reading about lattice attack on ECDSA when partial bits of nonce are known for amount of signatures, So i went through some source code trying to understand how it works. First of all, ...
0 votes
0 answers
62 views

Same message different nonce but similarities in r value of the signatures(r,s)

I'm studying a case where when i sign a same message with the same private key and a different nonce, i sometimes get signatures (r,s) where r values share some similarities (same numbers at the same ...
35 votes
4 answers
13k views

Can ECDSA signatures be safely made "deterministic"?

Using the terminology of the ECDSA Wikipedia page, ECDSA (and DSA) signatures require a random k value for each signature which ensures that the signature is different each time even if the message ...
0 votes
0 answers
45 views

Practical deployments of ECC with cofactor of elliptic curves $4$ or $8$?

Are cofactor $4$ and $8$ ECC schemes widely used in practical deployments such as those in cryptocurrencies? Can you name some practical settings where there curves are used and cryptocurrencies where ...
2 votes
1 answer
260 views

Does RFC 6979 unconditionally prevent nonce-reuse attacks?

Is RFC 6979 guaranteed to prevent the reuse of nonces for different signed hashes?
13 votes
2 answers
15k views

Why OpenSSH prefers ECDSA nistp256 keys over -384 and -521, and those over Ed25519, for host key verification?

According to ssh_config(5), HostKeyAlgorithms “specifies the host key algorithms that the client wants to use in order of ...
1 vote
2 answers
55 views

In ECDSA over K256, Why R.x should be less than the subgroup order, not field order? But in BIP340 over K256, should be less than field order

I understand that R.x is a field element. I don't understand why in ECDSA verification ie. FIPS 186-5 section 6.4.2 step 1, we check whether r is less than subgroup order. If it has something to do ...
9 votes
2 answers
6k views

Complete Set of Test-Vectors for ECDSA secp256k1

Although there are several implementations of ECDSA secp256k1 public available over the internet (the most popular being OpenSSL), it seems that there are no complete set of test-vectors available. ...
0 votes
1 answer
62 views

Reason for two random numbers in DSA?

Why is the signature in DSA the way it is? I am referring to $r$ and $k$ in the Signing-Algorithm depicted below. Is it really necessary to have both, $r$ and $s$, or would it still be secure if only ...
7 votes
2 answers
821 views

Goofs that could creep in ECDSA signature verification?

What are goofs that could creep in ECDSA signature verification, perhaps with focus on curves based on prime-order $\mathbb Z_p$, specifically P-256 aka secp256r1? Is it possible to construct test ...
0 votes
1 answer
48 views

Using plaintext + ciphertext combination as substitute for authentication/signature in elliptic curve cryptography

I'm working on a system where I need to sign some data using an ECC private key and share the data and signature over a BLE ADV packet. Since an ADV packet is limited in space, I can't use a full ...
2 votes
2 answers
230 views

Can we recover public key from DSA signatures as we can from ECDSA?

I learned the Public Key Recovery algorithm for ECDSA, and wonder if we can use it in DSA. The answer seems to be no, but details are welcome.
1 vote
0 answers
22 views

In DSA, can we tell if signatures are for the same key pair?

We are given some distinct DSA signatures $(r_i,s_i)$ and the distinct hashes $H_i$ of the corresponding messages. The signatures and messages are non-maliciously made per the same known group ...
3 votes
1 answer
761 views

When using ECDSA P-384 for signing and verifying messages, should the public key be also included **INSIDE** the message before signing?

I am using ECDSA P-384 for signing and verifying messages. The messages are basically stringified JSON. After receiving, the recipient verifies the signature using the public key. Should the public ...
2 votes
1 answer
624 views

ECDSA simpler formula?

In ECDSA, if Alice wants to send a message to Bob, she computes $s=k^{-1}(z+rd_A)$. I was thinking that the formula could simply be $s=k^{-1}zrd_A$ and the algorithm would work just as well, and the ...
9 votes
1 answer
10k views

How do RSA and ECDSA differ in signing performance?

Signature algorithms with elliptic curves have smaller output sizes compared to RSA for the same level of security. What about the processing time to generate a signature ? I've seen figures giving ...
0 votes
0 answers
93 views

Apple secure enclave with RFC6979

Does Apple secure enclave support rfc6979 with P256 curve? This RFC defines a deterministic ecdsa with a deterministic k value. THATS LINK OF THE RFC https://www.rfc-editor.org/rfc/rfc6979 I looked ...
4 votes
1 answer
146 views

ECDSA (ecrecover) - How an attacker can construct a hash and signature that look valid

I found information, that it is possible to construct a hash and signature that look valid if the hash is not computed within the contract itself (we are talking about ECDSA/ecrecover here). So, the ...
1 vote
0 answers
262 views

JavaScript SubtleCrypto - Is there a way to convert the ECDSA keys into a more "portable" format and preferably shorter? [closed]

I asked this question on StackOverflow but it seems like it's more appropriate for this Crypto community. I am using the browser built in SubtleCrypto library in javascript to generate public and ...
6 votes
1 answer
163 views

What's the current status of development of hedged ECDSA and EdDSA?

In the IETF Draft Deterministic ECDSA and EdDSA Signatures with Additional Randomness, methods had been specified to seed RNG deterministically with external input, to securely obtain a nonce for use ...

1
2 3 4 5
11