Questions tagged [dsa]

The Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. It was proposed by the National Institute of Standards and Technology (NIST) in August 1991 for use in their Digital Signature Standard (DSS), specified in FIPS 186, adopted in 1993. A minor revision was issued in 1996 as FIPS 186-1. The standard was expanded further in 2000 as FIPS 186-2 and again in 2009 as FIPS 186-3.

Filter by
Sorted by
Tagged with
2
votes
0answers
18 views

Schnorr groups allowing fast modular reduction, vs GNFS

I'm looking for Schnorr groups allowing fast modular reduction. Say, using the notation in DSA, with 256-bit $q$ and 3072-bit $p$. Are there standards, RFC, or other references about this? I'm ...
1
vote
0answers
44 views

Security of an ECDSA Adaptor Signature Implementation

I'm currently working on an implementation of ECDSA Adaptor Signatures, and part of the signature scheme calls for a NIZK proof to verify knowledge of exponent over two public keys that share a ...
0
votes
0answers
64 views

An “unsafe” curve over RSA? [duplicate]

I'm implementing a token server and considering backing them with ECDSA. The options from the library I'm using expose the NIST curves P-256, P-384, and P-521. The safe curves site does not list P-521,...
2
votes
2answers
107 views

Is it OK to use r-value from ECDSA signature (r, s) to prevent replay attack?

ECDSA signatures are malleable. Given a valid signature (r, s), one can create a second valid signature by negating the s value. I have searched workaround for this issue, and https://yondon.blog/2019/...
5
votes
1answer
486 views

What is the Lord of the Ring(s): Side Channel Attack and What are the results

A recent Paper to appear on USENIX Security 2021 titled as Lord of the Ring(s): Side Channel Attacks on the CPU On-Chip Ring Interconnect Are Practical by Riccardo Paccagnella Licheng Luo Christopher ...
0
votes
1answer
136 views

How to compare the time of encryption, cracking and verification elliptic curve problem in the same framework?

everyone! As a beginner, I would like to ask you a question. The best algorithm known for cracking (done by anonymous snooper) this problem (Discrete logarithm problem of elliptic curve or ECDSA)is ...
0
votes
1answer
47 views

Elliptic curve in Binary Field implementation

For Elliptic curves defined over $GF(2^n)$, by adding any two points P and Q over $GF(2^n)$ we get the third point over $GF(2^n)$. In Elliptic Curve Digital Signature Algorithm (ECDSA) https://en....
13
votes
1answer
948 views

Making ECDSA public keys one bit shorter

In compressed form, ECDSA public keys are one bit larger than the curve size. There are some situations where this extra bit is extremely inelegant. So I had the following idea as a way to remove it. ...
1
vote
1answer
112 views

How did this group discover m wasn't random?

In this video a group of "hackers" describe how they discovered private keys for the PS3 that was using this ECDSA algorithm by discovering that the "random" integer $m$ (or $k$ in ...
0
votes
0answers
45 views

Guarding against vulnerabilities for a digital signature service (RSA )

Lets's say I have a cipher-module / cryptography-service that signs a hash of some unknown payload. What are the possible attacks that I would need to guard against in this context (primarily assuming ...
1
vote
0answers
125 views

Calculating ECDSA Private Key From Multiple Signatures With Shared k (random nonce)

I've been experimenting with ECDSA signatures and with how the Sony PS3 private key was leaked. Specifically where: $$k = \frac{z_1 - z_2}{s_1 - s_2}$$ $$d_A = \frac{z_1s_2 - z_2s_1}{k(s_1 - s_2)}$$ ...
1
vote
1answer
33 views

ecdsa nonce reuse to compute the private key, modular inverse question

I am following along some cryptography challenges:, in particular ECDSA Nonce Reuse here (second problem): https://blog.coinbase.com/capture-the-coin-cryptography-category-solutions-fe94d82165c5 I ...
1
vote
1answer
71 views

Security level of DSA when $q$ is a 224 bit prime?

What is the security level of DSA algorithm when $q$ is a 224 bit prime? Is it always a simple rule that the security level is the bit length of $q$ divided by two ?
6
votes
1answer
365 views

Is there any reason not to use EdDSA with Weierstrass curves?

I'm volunterely working for a crypto library and we're planning on adding Curve25519 support (finally). At the same point I had the idea of adding support for EdDSA in the same run. Our library is ...
10
votes
1answer
6k views

What is the difference between ECDSA and EdDSA?

As I understand it, both work with elliptic curves, but there seems to be a difference as EdDSA is generally recommended over ECDSA.
3
votes
0answers
82 views

How can the Number Field Sieve attack the discrete log in $\mathbb Z_p^*$ of DSA?

The Digital Signature Algorithm (DSA) uses $L$-bit prime $p$ and $N$-bit prime $q$ with $q| p-1$, i.e., $p = r\cdot q +1$ ( Schnorr group if $r>2$ and safe prime if $r=2$). In a way, the security ...
1
vote
1answer
12 views

DSA parameter selection

In the Digital Signature Algorithm, is there a reason why the larger prime parameter should be an $N$-bit prime where $N$ is a multiple of 64 ? Is this strictly necessary for proper working of the ...
2
votes
1answer
127 views

How is EdDSA different from ECDSA with a custom curve?

I just found this draft/informal IETF specification: Alternative Elliptic Curve Representation: This document specifies how to represent Montgomery curves and (twisted) Edwards curves as curves in ...
16
votes
2answers
21k views

What curve and key length to use in ECDSA?

I'm developing a client/server system in Java which is not interacting with third-party software, so I don't have to worry about compatibility. At a certain point, I need the client and server to ...
0
votes
1answer
91 views

Does it make any sense to hash parts of a hashing target?

TL;DR; Assuming I'm calculating SHA256 for an ECDSA, does it make sense to do SHA256(item1 + SHA256(item1') + item2 + SHA256(item2') + itemN + SHA256(itemN')) or it'...
27
votes
1answer
12k views

ECDSA, EdDSA and ed25519 relationship / compatibility

I'm trying to understand the relationship between those three signature schemes (ECDSA, EdDSA, and ed25519) and mainly to what degree they are mutually compatible in the sense of key-pair derivation, ...
1
vote
0answers
53 views

ECDSA sign test vectors

I've seen a large set of ECDSA test vectors for verification. In addition, I've seen some test vectors from NIST, and those can be found here. Is anyone aware of ECDSA sign test vectors which, if &...
1
vote
0answers
35 views

Understanding multiplication of Shamir secret sharing during threshold (EC)DSA signing

I have been looking at the threshold (EC)DSA schemes for honest majority by Gennaro et al. https://www.sciencedirect.com/science/article/pii/S0890540100928815. In the scheme, there are steps where we ...
11
votes
1answer
4k views

ECDSA vs RSA: Performance on Android platform and surprising results

For our privacy-preserving protocol, an encrypted channel is established. In order to protect our system from man-in-the-middle attacks, a signature-based approach is used. After we've implemented it ...
1
vote
1answer
68 views

Can ECDSA signature signing and verification process replaces password hashed based login system?

ECDSA or DSA in general was to sign a message or data using private key and verify it using public key, if the attacker/imposter doesn't have the private key then they couldn't sign the message ...
0
votes
1answer
85 views

ECDH/ECDSA key exchange on embedded devices

Two devices are communicating only with each other and shall do this with AES encryption. Both devices are offline, have very limited storage and use a small cryptographic coprocessor which is able to ...
0
votes
1answer
91 views

Calculating the point on the curve during ECDSA signature verification

I'm confused as to how he got (62, 44) as an answer within this article: https://www.coindesk.com/math-behind-bitcoin
0
votes
1answer
66 views

Calculating ECDSA m or k (k or d) when s1 = s2

I recently began to look into some information about obtaining the private key $k$ when two signatures have been produced using the same $m$ and $k$. I've been using the well-publicised information ...
2
votes
1answer
93 views

Problem with the signature of message using ECDSA over GF(2^m)

I'm trying to set up an ECDSA with Elliptic Curves over $\operatorname{GF}(2^m)$ with an example of toy with the following values: Using the Weierstrass equation on binary finite fields. $$E: y^2 + x*...
0
votes
0answers
29 views

Which signature is considered more secure and has less communication cost?

This article uses Elliptic Curve Cryptography, but when it comes to signing and verifying messages it is not using the ECDSA signature algorithm. In the article, they mentioned that the communication ...
3
votes
2answers
257 views

Elliptic Curve Digital Signature algorithm fails

I would like to monitor step by step running of ECDSA. Parameters I am working on: The elliptic curve satisfies the equation: $y^2 = x^3 + x + 1$. I picked up the base point $G$ as: $(0, 1)$ Finally,...
0
votes
0answers
44 views

Is this a good implementation of digital signature with timestamp?

Is this a good practice ?. How good or bad is this compared to appending a timestamp to the actual data and hashing it as represented below. ...
6
votes
1answer
9k views

Should I use RSA encryption since RSA is said to be broken by NSA?

I am developing a simple web app that uses asymmetric encryption, but I am not sure whether to chose RSA for the reasons mentioned above. What are your suggestions? Also if I decided to go with RSA ...
0
votes
0answers
50 views

Can private key used in ECDSA be discovered when many signatures were colleced? [duplicate]

Can private key used in ECDSA be discovered when many signatures of different messages were collected (1M+) or may signatures of the same message were collected? Will small nonce bias be easily ...
0
votes
0answers
45 views

Vulnerability in the Digital Signature Algorithm. Can I calculate k and x?

I feel DSA is vulnerable if k is randomly selected over a small set, example, {1,2,...,2^16 -1}. I am trying to come up with a program where I assume I have the public parameters (p,q,g) , public key :...
0
votes
2answers
96 views

The Generator point and Mod P in ECDSA

I've been reading about The discrete logarithm problem as of recent and i decided to try it out on a small portion of numbers myself and i actually came to a mental gridlock after watching this Video....
1
vote
2answers
71 views

Can the ECDSA still work without present of hashing function? [duplicate]

According to walkthrough steps for ECDSA topic from wikipedia as shown below, What if the impact if we don't apply the hashing function (highlighted in blue in the image) to the raw messages? Although ...
1
vote
2answers
71 views

Using different hashing function with ECDSA

I came across an IC device configuration & security flow and the details are illustrated in image below. I'm wondering must the ECDSA pair with the SHA Hashing function? Alternatively, what if ...
1
vote
1answer
63 views

What is the use of pre-computed points in ECC?

I am trying to understand the use of pre-computed points in ECC for ECC signature, verification, key generation, and so on. After searching on the internet, I understand that pre-computed points aid ...
0
votes
1answer
73 views

TLS 1.2 Server Key Exchange problem

Below the Wireshark snapshot of the handshake compliant to the TLS 1.2. The position 1 displays the enum ServerECDHParams where I can use any curve having the own ID RFC8422. I'm free for example to ...
0
votes
0answers
51 views

how to efficiently compute private key in DSA with known parameters

For textbook DSA, as defined below. If $r, s, k, g, p, q, m$ are all known, is it possible to efficiently compute $x$ from all these given values? How does the math work out? Secret key: $x\stackrel ...
2
votes
2answers
140 views

ECDSA signature generation and verification latency

I am performing some measurements of P256 ecdsa signature generation and verification latency and I was expecting that the signature verification will be faster than the signature generation, but is ...
3
votes
0answers
76 views

Constant time arithmetic implementation in DSA

I am trying to understand why it is a hard problem to have formally verified constant time arithmetic for DSA when compared with ECDSA. For instance, in ECDSA implementations of OpenSSL, we have ...
0
votes
0answers
70 views

Cryptanalytic tests for biased nonces

In the paper Biased Nonce Sense: Lattice Attacks against Weak ECDSA Signatures in Cryptocurrencies on section 5.2 Cryptanalytic tests for biased nonces, one of test is: Select two signatures at ...
1
vote
1answer
107 views

Is it possible to safely implement the Signal Protocol (X3DH) without using XEdDSA

In the X3DH specification of the Signal Protocol it mentions having a signed pre-key in the key bundle. This pre-key is signed using the identity private-key. Because the identity private-key is in ...
4
votes
1answer
109 views

ECDSA: with knowledge of private key, can we make signatures with partially chosen content?

In ECDSA, with knowledge of private key, can we make signatures with partially chosen content? Detailing that: In ECDSA (with secp256r1 curve and SHA-256 hash), assume we know the private key, the ...
3
votes
2answers
1k views

Difference between X25519 vs. Ed25519

I am reading https://en.wikipedia.org/wiki/Curve25519 and it states Also in 2018, RFC 8446 was published as the new Transport Layer Security v1.3 standard. It requires mandatory support for X25519, ...
1
vote
1answer
83 views

Can you use ECDSA on pairing-friendly curves?

I'm learning about Elliptic curve cryptography. If I understand right, ECDSA and other algorithms used in ECC are dependent on the curve chosen. So, before you want to use ECDSA, you first have to ...
4
votes
2answers
632 views

Are (EC) DSA blind signatures possible?

I've been searching for a way to create blind ECDSA signatures. My research and experimentation has led me to believe that this is not possible. I've been attempting to articulate why and I think ...
1
vote
1answer
265 views

How Does Prime Factorization Break ECDSA?

I have heard that ECDSA will be broken in the not-to-distant future (roughly 15-25 years) by Quantum Computers running Shor's Algorithm. However, to my understanding, the only purpose of Shor's ...

1
2 3 4 5
8