# Questions tagged [dsa]

The Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. It was proposed by the National Institute of Standards and Technology (NIST) in August 1991 for use in their Digital Signature Standard (DSS), specified in FIPS 186, adopted in 1993. A minor revision was issued in 1996 as FIPS 186-1. The standard was expanded further in 2000 as FIPS 186-2 and again in 2009 as FIPS 186-3.

532 questions
Filter by
Sorted by
Tagged with
26k views

### ECDSA Signature R|S to ASN1 DER Encoding question

I am trying to test my understanding on ECDSA Signature r|s to ASN.1 DER Encoding for NIST P-256. I have r|s and when I convert ...
1 vote
60 views

### Does unlimited signing oracle leak the private key?

I am writing a PC software that uses a type of USB dongle as licensing key. The dongle functions as a signing oracle and does nothing more: Given any message $M$, it first pads $M$ to $PadM$, then ...
1 vote
93 views

### RFC6979: Can deterministic ecdsa signature diverge with same key and message?

As I understands, RFC6979 uses deterministic K which is generated by HMAC-SHA256(private_key, message). In this way, I guess if same key with same message, ecdsa signature generated would be always ...
27k views

### How does recovering the public key from an ECDSA signature work?

It is possible to recover the public key from an ECDSA signature values $(r,s)$? Please explain how this works.
1 vote
87 views

### Math of Hint usage in Dilithium

For Dilithium, I understand that $$\text{HighBits}(\mathbf{Ay}) = \text{HighBits}(\mathbf{Ay} - c\mathbf{s_2}) = \text{HighBits}(A_z - c\mathbf{t})$$ The first term of the equation is performed on the ...
1 vote
92 views

### Is it possible to break a DSA with k that increases statically?

I am currently studying cryptography. I came across this problem: I had an exercise that as a vulnerability had that k is generated every 10 seconds: ...
1 vote
177 views

### Need help with Cryptohack's ProSign 3 ECDSA problem [closed]

I'm trying to solve the CTF challenge called ProSign 3 at Cryptohack platform which involves exploiting an ECDSA signing service that allows us to sign a fixed message being padded with the time ... ...
238 views

### Split a private key into shares and sign successively or separately

Assume I have a private key, priv_k, a public key pub_key and a message, msg, along with its ...
335 views

### Blinding an ECDSA private key without learning the private key

I am looking at ways to blind an ECDSA signing key (and verification key respectively). Looking at proposed solutions like the IETF KBSS draft, and the IETF ARKG draft it seems that the ECDSA key ...
1 vote
56 views

### Single ecdsa signature valid for two different messages

I have been reading Flaws in Applying Proof Methodologies to Signature Schemes and ran into a bit I do not understand. In section 4.2 the authors describe a scheme where a malicious signer crafts a ...
86 views

### Small subgroup attack when using a Schnorr group for DHKE

One uses a Schnorr group both for Schnorr signature (or DSA), and for Diffie-Hellman Key Exchange. They target 128-bit security, and choose prime $q$ that's 256-bit, prime $p=q\,r+1$ that's 3072-bit, ...
1 vote
67 views

47 views

### Is this ECDSA's protection mechanism or something wrong with it?

Over the past few months, I have been reading and trying to understand how ECDSA works and how safe is it. So now something does not add up between its signature verification and generation. But maybe ...
56 views

### Framework for manipulating digital signatures

for a research project, i am currently looking for a way to manipulate the digital signature of a HTTPS TLS message flow. More specifically, i am trying to create a working example for a malicious ...
135 views

### Can lattice attack work MSB or LSB are unkown but 16 bytes of private key are known?

I have been reading about lattice attack on ECDSA when partial bits of nonce are known for amount of signatures, So i went through some source code trying to understand how it works. First of all, ...
70 views

### Same message different nonce but similarities in r value of the signatures(r,s)

I'm studying a case where when i sign a same message with the same private key and a different nonce, i sometimes get signatures (r,s) where r values share some similarities (same numbers at the same ...
13k views

### Can ECDSA signatures be safely made "deterministic"?

Using the terminology of the ECDSA Wikipedia page, ECDSA (and DSA) signatures require a random k value for each signature which ensures that the signature is different each time even if the message ...
47 views

### Practical deployments of ECC with cofactor of elliptic curves $4$ or $8$?

Are cofactor $4$ and $8$ ECC schemes widely used in practical deployments such as those in cryptocurrencies? Can you name some practical settings where there curves are used and cryptocurrencies where ...
271 views

### Does RFC 6979 unconditionally prevent nonce-reuse attacks?

Is RFC 6979 guaranteed to prevent the reuse of nonces for different signed hashes?
17k views

### Why OpenSSH prefers ECDSA nistp256 keys over -384 and -521, and those over Ed25519, for host key verification?

According to ssh_config(5), HostKeyAlgorithms “specifies the host key algorithms that the client wants to use in order of ...
1 vote
68 views

### In ECDSA over K256, Why R.x should be less than the subgroup order, not field order? But in BIP340 over K256, should be less than field order

I understand that R.x is a field element. I don't understand why in ECDSA verification ie. FIPS 186-5 section 6.4.2 step 1, we check whether r is less than subgroup order. If it has something to do ...
Why is the signature in DSA the way it is? I am referring to $r$ and $k$ in the Signing-Algorithm depicted below. Is it really necessary to have both, $r$ and $s$, or would it still be secure if only ...