Questions tagged [dsa]

The Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. It was proposed by the National Institute of Standards and Technology (NIST) in August 1991 for use in their Digital Signature Standard (DSS), specified in FIPS 186, adopted in 1993. A minor revision was issued in 1996 as FIPS 186-1. The standard was expanded further in 2000 as FIPS 186-2 and again in 2009 as FIPS 186-3.

Filter by
Sorted by
Tagged with
2
votes
1answer
70 views

Is there any proof for ECDSA signature algorithm?

Related: Is there an interactive version of ECDSA signature protocol like the Schnorr identification protocol?
3
votes
1answer
140 views

Likelihood of signature collision with EdDSA

Taking EdDSA as an example, given the length of a signature is 512-bits for a given data payload, what is the probability of a collision where there is another 512-bit value that is also a valid ...
4
votes
2answers
2k views

Recovering private key from Secp256k1 signatures

I've seen many answers here and many articles that says we can recover the private key from reused R signatures. But, what if the r,s signatures are different in transaction of bitcoin then is there a ...
0
votes
0answers
58 views

Signing a secret key with ECDSA

Assume Alice and Bob both separately come into possession of the same randomly generated 256 bit secret key. Alice has Bob's public ECDSA key. Alice wants to verify that Bob has possession of the ...
3
votes
1answer
190 views

DSA: If signature is accepted then signature is correct

In one my classes, I have the following exercise: Prove that, in the DSA signature scheme, if a DSA signature is accepted, it is also correct. How would I go about proving this? In cryptography, ...
18
votes
2answers
1k views

Can deterministic ECDSA be protected against fault attacks?

In a paper by Barenghi and Pelosi, it was described that fault attacks could be used to derive the secret key when using deterministic ECDSA as described in RFC6979 by @Thomas_Pornin Deterministic (...
1
vote
2answers
859 views

What kind of ECDSA signature encoding is this?

I am trying to generate an ECDSA signature using ARM's CryptoCell 310 (hardware cryptography module) and verify the signature using mbedTLS software library. The harware module documentation says ...
2
votes
1answer
61 views

ECDSA Private Key from SSS

I have all of the Shamir's secret shares required to Lagrange-interpolate f(0), which represents an ECDSA private key. The field of this object is ...
0
votes
0answers
15 views

Complexity upper bound MFC DSA with linear S-Box

in advance, excuse my eventuelly bad english. It's not my mother tongue. I work on a coolege Computer Science Project. For this, i need to know the upper bound of the complexity for the MFC( Formal ...
7
votes
1answer
454 views

Is it possible to decrypt an ECDSA private key if the same nonce is used across different private keys?

If the same nonce is used across different messages under the same private key, the private key can be easily revealed. However, let's consider another scenario. Two private keys, x1 and x2, are ...
3
votes
1answer
758 views

Can Montgomery ladder multiplication be used with secp256k1?

While reading about Elliptical Curves and ECDSA, I found a paper ECDSA Security in Bitcoin and Ethereum: a Research Survey by Hartwig Mayer. On page 6, the authors say: The curve secp256k1 does not ...
3
votes
1answer
157 views

ECDSA signature verification checks

From Wikipedia: Check that $Q_a$ is not equal to the identity element $O$, and its coordinates are otherwise valid. Check that $Q_a$ lies on the curve. Check that $n*Q_a = O$ Verify that $r$ and $s$ ...
1
vote
1answer
162 views

Understanding example of ECDSA P256

I am new to cryptography, I found the below Example on a nice website, but I am not able to understand the most of the terms used (H:Hash, K:Random number,E=?, Kinv=?,Rx=?=RY?,R=Private key?,D?,S? ...
1
vote
1answer
33 views

X.509 ECDSA signature field in DER format includes '00' between bit string and sequence of r and s

I created a X.509 certificate with ECDSAwithSHA256(OID=1.2.840.10045.4.3.2) by openssl. ECC parameter is secp256r1. Following is the signatureAlgorithm and signatureValue. ...
0
votes
1answer
34 views

Disk storage of RSA and DSA keys

I have generated one RSA-2048 signing key and one DSA-2048 signing key, using gpg command gpg --full-generate-keys I would expect the key to have size 2048 bits, ...
1
vote
2answers
61 views

How to properly sign and verify using DSA? Can anyone spot my mistake?

The question that I am trying to answer is as follows: 10.14. The parameters of DSA are given by p = 59,q = 29,α = 3, and Bob’s private key is d = 23. Show the process of signing (Bob) and ...
2
votes
1answer
69 views

Verify ECDSA signature without data

With RSA PKCS#1 v1.5 it is possible to verify that the signature was generated by the correct private key without actually having access to the data. You just perform the modular exponentiation with ...
0
votes
1answer
39 views

ECDH Public Key Recovery - Determine if valid key exists from just signature and message

If I have just the (r,s,v) values of the signature and the message hash, what is the most efficient way to determine if a valid public key exists? I do not need to know the public key, just that the ...
0
votes
0answers
52 views

Comparisons of ECDSA, EdDSA and BLS Signatures in Blockchain: Pros and Cons

As we know, the most used digital scheme in Blockchain is ECDSA. For now, more and more blockchain projects, I've noticed, are considering substituting EdDSA and BLS signature scheme as the new one. ...
1
vote
2answers
748 views

ECDSA threshold signing

I searched "ECDSA threshold signing" recently and found a lot of papers where it is said that their authors solved the problem of ECDSA threshold signing efficiently: e.g. here and here. Why there ...
1
vote
1answer
112 views

Why is a prime number used in ECDSA?

So I need to write a piece for school about ECDSA and how it is secure. Now I thought I had a simple question, however, I can't seem to find an answer anywhere: Why does the p in the formula need to ...
7
votes
1answer
1k views

Elliptic curves for ECDSA

I'm trying to implement parameters generation for ECDSA according to SEC1 v2.0: ...
0
votes
1answer
61 views

Is it secure to use ECDSA for any arbitrary point on the Elliptic Curve as the Generator point?

My question concerns the elliptic curve $E$ over a prime field $\mathbb F_p$. To the best of my understanding, ECDSA requires a Generator point $G$ of prime order $n$, and the $r$ and $s$ values of ...
10
votes
3answers
20k views

Using ECDSA keys for encryption

I know that ECDSA is used for signature only, but I wonder if I can use the public/private Elliptic Curve keys for encryption too. I have ECDSA SSH public keys and I wonder if I can use them to ...
5
votes
2answers
3k views

How to generate a public key from a private ECDSA key?

Having some specific ECDSA curve and a private key, how does one calculate the public key? I am having a hard time finding the algorithm and equations for it.
0
votes
1answer
450 views

How trivial is it to derive a private key from two public keys?

It turns out that what I was attempting to do was create a form of ECDSA threshold signature protocol by just giving away multiple public keys and then having the two parties solve for the private. ...
8
votes
2answers
327 views

What is TPMFail attack and what are the countermeasures?

Trusted Platform Module (TPM) is designed as a hardware-based root of trust to protect cryptographic keys even against system based adversaries. Although Intel's firmware based fTPM has FIPS 140-2 ...
1
vote
1answer
83 views

DSA - can $k$ be 1?

I'm learning DSA and I'm wondering if $k$ can be 1. I know that k has to be from $\mathbb{Z}_{q-1}$ but I don't know whether 1 is allowed (not talking about security concerns, purely educational). I ...
2
votes
1answer
453 views

ECDSA where the group order is larger than the hash size?

According to wikipedia, when generating a signature for ECDSA, you do the following (among other things): Calculate $e=\operatorname{HASH}(m)$, where $\operatorname{HASH}$ is a cryptographic ...
0
votes
1answer
43 views

DSA authenticity/integrity

Does checking sig with DSA implies both that the sender is verified , and the msg is original without change of any bit? (case i dont have a reference HASH for that file, only public key)
-2
votes
1answer
92 views

ECDSA multiplication vs exponentiation

In Elliptic Curve Digital Signature Algorithm (ECDSA) I often see 2 different written equations of it: Elliptic curve point multiplication by a scalar, $Q_{A}=d_{A}\times G$, source Modular ...
26
votes
3answers
7k views

Can ECDSA signatures be safely made “deterministic”?

Using the terminology of the ECDSA Wikipedia page, ECDSA (and DSA) signatures require a random k value for each signature which ensures that the signature is different each time even if the message ...
2
votes
1answer
548 views

ECDSA with common nonce?

I'm new to cryptography, and I've searching about ECDSA because I'm trying to solve a CTF. I've already check this site and Google, and I think I'm in the right path, but probably I am missing ...
0
votes
0answers
44 views

In DSA digital signature, why does k have to be random and unique each for each signing? [duplicate]

If we repeat k, I think there is little chance for s to repeat since user's private key x is ...
1
vote
3answers
1k views

Which hash function is used for signatures ssh-rsa and ssh-dss?

I'm building a fuse client for ssh/sftp. I write the required ssh and sftp functions myself. Now I read in RFC4253 that before signing the data to sign is default hashed. In RFC4253 8. "Diffie-Hellman ...
2
votes
3answers
557 views

Why are in asymmetric cryptography as many keys as people involved needed?

The question: "10 friends wish to establish secure communications between themselves using asymmetric-key cryptography. How many keys need to be known by each user?" was posed by my teacher. He says ...
2
votes
1answer
597 views

What is the difference between: ecdsap, ecdsak, and ecdsab in the output of “openssl speed”? What do the letters P/K/B refer to?

openssl speed tests the speed of different protocols on your computer: ...
0
votes
0answers
40 views

Signing with ECDSA [duplicate]

I am new to ECC. I was reading this post https://andrea.corbellini.name/2015/05/30/elliptic-curve-cryptography-ecdh-and-ecdsa/ I want to know if there is any intuition behind the following formula: $...
1
vote
1answer
253 views

DSA signature generation [duplicate]

I am trying to implement given DSA signature generation instructions in python, there are few instructions that I couldn't understand in step 3 and 4. Let m be an arbitrary length message. The ...
3
votes
1answer
367 views

Attack on DSA modification with bad hash function

Given a (bad) modification of DSA where the hash function is the identity ($H(m)=m$), I am now supposed to design an attack. So $(m, (r,s))$ are given and I should be able to create a legit signature $...
4
votes
1answer
5k views

Does the size of a ECDSA key determine the hash algorithm?

I am a bit lost in understanding what I read on authentication, signature, etc. For instance, is the size of the ECDSA keys produced by ssh-keygen -t ecdsa -b 256 ...
1
vote
1answer
3k views

What is the recommended minimum key length for ECDSA signature

I want to identify the proportion of certificates that use unrecommend ECDSA key length for TLS certificates based on some data I collected. By looking at a standard like NIST for example, I find ...
1
vote
3answers
234 views

Digital Signature Algorithm for large files - bottle-necked by hash function?

I am new to studying digital signatures like ECDSA and EdDSA, and was curious about something. Lets say hypothetically I want to create a digital signatures of millions of files, with a total size of ...
1
vote
2answers
1k views

DSA Vulnerability in ECDSA

I have implemented a ruby code where i generate private and public keys as below. However, I read few articles [1] on DSA and why it should not be used. I'm not good at cryptography. But still ...
2
votes
1answer
174 views

Encoding a message to a point of curve y^2=x^3+7 and Bitcoin Core

Where should I look at in Bitcoin Core source code to figure out how the signature process transform a message in a curve point? To sign a transaction (message) in the Bitcoin system, you need to ...
1
vote
1answer
76 views

Elliptic curve one time signatures

This is kind of an academic question, but I wonder if it's possible to build an intentionally one-time signature scheme with elliptic curves? I assume you could do it by supplying ECDSA with ...
3
votes
1answer
227 views

Is ECDSA signature strongly EUF-CMA?

I read, here, that ECDSA signature is EUF-CMA but not SUF-CMA, aka sEUF-CMA (for strong existential unforgeability under adaptively chosen message attacks; see terminology there). Specifically, the ...
5
votes
1answer
674 views

Why doesn't this replay attack work on ECDSA?

I've just started working with elliptic curves and ECSDA in particular, so my understanding of the underlying math isn't great. The thing I'm currently stuck on is trying to understand why replay ...
1
vote
1answer
75 views

Is this API for ECDSA signature verification consistent with NIST test vectors?

I'm trying to use code from "Easy ECC" package (a github project), for ECDSA-verifying a signature. The problem I'm facing is that the API assumes a public key length of N+1, which is different than ...
11
votes
3answers
15k views

Why can’t DSA be used for encryption?

This question at StackOverflow mentions that DSA cannot be used for encryption. But both RSA and DSA can be used to generate public and private keys, right? Then why can't I use the DSA public key to ...

1
2 3 4 5
8