Questions tagged [dsa]

The Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. It was proposed by the National Institute of Standards and Technology (NIST) in August 1991 for use in their Digital Signature Standard (DSS), specified in FIPS 186, adopted in 1993. A minor revision was issued in 1996 as FIPS 186-1. The standard was expanded further in 2000 as FIPS 186-2 and again in 2009 as FIPS 186-3.

Filter by
Sorted by
Tagged with
1
vote
1answer
39 views

Which application protocols use elliptic curve key recovery?

Section 4.1.6 of https://www.secg.org/sec1-v2.pdf describes a technique for recovering public keys from ECDSA signatures. I guess Ethereum uses this. Like if you want to validate a particular ...
0
votes
1answer
50 views

Possible to directly calculate the Recovery ID from a msg, signature and public key in ECDSA/secp256k1?

Problem Let's say I receive a signature $(r,s)$, the corresponding public key and the message that was signed. I don't have access to the private key. I need to know what the ...
0
votes
1answer
75 views

Is it possible to generate ECDSA signature without nonce?

I am newbie to cryptography and my college has given me this ECDSA. I know that you have to divide result of: h(m)+r.priv in order to generate signature. But is it possible to generate signature ...
0
votes
0answers
46 views

Avoid MITM Attack in ECDH Without HTTPS or a Third Party Certificate Authority

My context: I have a ECHD protocol, my main concern is MITM attack, it doesn't matters if you do HMAC or anything else in future to sign requests if your key exchange is compromised, Far from https ...
2
votes
1answer
125 views

Is the STARK Curve a SafeCurve?

SafeCurves defines criterias for choosing safe curves in elliptic-curve cryptography. STARK Curve defines a Stark-friendly elliptic curve that can be used with ECDSA. I was wondering: Is the STARK ...
2
votes
1answer
57 views

Are the FIPS 186-5 and ANSI X9.142-2020 definitions of ECDSA consistent?

FIPS 186-4 Digital Signature Standard defers to ANSI X9.62-2005 for the specification of ECDSA, with additional requirements set out in Chapter 6 and Appendix D. However, X9.62-2005 has since been ...
-1
votes
1answer
23 views

Dsa generator verify problem

I'm trying to generate a signature for DSA with the following parameters: p=67 , q=11 , g=38 , H(m)=7 , x=6 (Is it correct to choose g=38?) I cannot choose a random k (0>k>q) that will give me r ...
1
vote
0answers
30 views

Finding an element of $\mathbb{Z}_p$ if the order of that element is known [duplicate]

I have two prime numbers $p$ (1024 bits) and $q$ (160 bits) such that $q$ divides $p-1$. Now I want to find an element $b$ in $\mathbb{Z}_p$ with the order of $q$. That means that $b^q \equiv 1 \mod p$...
1
vote
1answer
45 views

Reusing additional data k' nonce from RFC6979 ECDSA

It is known that you must not reuse k in ECDSA; doing so will leak your private key. That's one of the reasons RFC6979 deterministic signatures were invented. Now, ...
0
votes
0answers
45 views

How to get public key and bitcoin compressed address from the coordinates (x,y) generated by ECDSA?

I have my x (0xca668a8b5f71e8724aada4b5343c28702a481787855cc42228b8fff97fe94d6a) and y (0x19dd3a603a55b3d8c5f62cbe177b9b63693fb8c91d76845bafc843a7aa19ea55) coordinates generated by ecdsa with a ...
0
votes
0answers
12 views

How to sign CAM/DENM messages using mbed LTS libray with ECDSA (EEE Std 1609.2)

I have read ETSI TS 103 097 and EEE Std 1609.2 which gives me the security data structure defined in ASN.1 notation. I want to use mbed LTS to calculate the ECDSA signature. I understand that I should ...
2
votes
0answers
58 views

Short Nonces in ECDSA signature generation

Recently I noticed that my device generates short-sized Nonces. Approximately $2 ^ {243} - 2^{244}$. Could it turn out that there will be a small leak of ...
0
votes
0answers
36 views

Cryptography (DSA) Get Value of k and private Key

i am on a task in cryptography and need a hint (PLEASE NO SOLUTION). The Task is: I can send Messages (Digital Numbers) to a Docker Container. The response are the values p,q,g,z1,s,r and hashvalue(m+...
1
vote
1answer
113 views

Signing same message 2 times with ECDSA

Can multiple signatures of the same message with the same private key (different nonces) lead to a private key trace?
0
votes
0answers
36 views

Is it possible (and if so how) to make one proof for multiple private keys in ECDSA

Lets say I have a message that needs to be signed by two keys that were generated using ECDSA Is it possible to make a signature that accounts for both keys, meaning I can verify with both and see ...
0
votes
1answer
174 views

Can I know from a Bitcoin public key if the private key is odd or even?

Can I know just from a Bitcoin public key if the private key is odd or even? [moderator note] That is, can we find parity of the private key from a secp256k1 public key?For the original dump of ...
0
votes
0answers
39 views

Why does ECDSA produce a pair of values in its' signature (r,s)?

I was wondering why ecdsa generates a signature in form of a pair (r and s) and why it can't be only one value.
0
votes
0answers
36 views

Can the same public key be used for ECDH and ECDSA [duplicate]

I want to generate a public key that I can use to sign messages and receive messages (using ECDH for exemple). I want to do so to have the smallest payload to share. Is it possible and proved secure ?
1
vote
1answer
160 views

Is RSA the only current practical option for asymmetric encipherment of symmetric keys at rest?

As of 2021, is RSA the only practical (i.e. safe, production-ready) option for asymmetric encipherment of symmetric keys at rest? ECDSA is obviously preferable over RSA in the case of signing, but (...
1
vote
1answer
47 views

Find the product of two sums via SMPC

I'm currently working on a distributed threshold DSA scheme that requires to find the product of two sums via secure multi-party computation. Specifically speaking, every one of $n$ parties $P_i$ ...
0
votes
1answer
81 views

Chinese remainder theorem in ECDSA for parameters in secp256k1?

It is known that it is possible to apply the Chinese remainder theorem and attack RSA under precise conditions. https://tls.mbed.org/public/WSchindler-...
1
vote
2answers
166 views

Is the verification process in ECDSA the same or different from in RSA?

With an RSA key pair, from my understanding, Alice who holds the private key is able to encrypt a message into a signature. She would then send the signature together with her original message to Bob. ...
1
vote
1answer
51 views

Confusion over recovery of privatekey in DSA signature when duplicate value of r occurs

In DSA signature where signing is done via $$s = k^{-1}(H(m) + xr) \mod{q} $$ I understand why if two messages singed by the same private key $x$ use the same $k$ value you can recover the private key ...
3
votes
1answer
168 views

Why check for point-at-infinity during ECDSA verification?

The ECDSA standard mandates that during verification we check that an intermediate calculation does not lead to the point-at-infinity (see Step 5. in this summary on Wikipedia ). But why do we check ...
1
vote
0answers
58 views

Sentinel ("trick") values for lattice attack on DSA with biased k (MSB)

I'm studying lattice attack using this sage script. There are 2 options in script: LSB and MSB. The most interesting option for me is MSB. It recovers private key with less then 100 signatures ...
2
votes
2answers
212 views

Question about coefficient of ECDSA in lattice attack

Update: I made my lattice attack worked finally. As the actual reason is quite complicated I decide to write an answer below to describe how it worked so anyone with similar question might get ...
1
vote
0answers
63 views

Security proof about RFC 6979

In the paper: "The Random Oracle Model: a Twenty-Year Retrospective", section 7.3 by Koblitz & Menezes,the authors tried to prove the security of ECDSA+. But after looking at the entire ...
0
votes
1answer
73 views

Why does RFC 6979 need so many loops?

I recently started reading RFC 6979. I'm curious why it needs so many loops. This post asks a similar question: "RFC 6979 - Why not simply hash the message & the private key for deterministic ...
1
vote
1answer
98 views

Why does deterministic ECDSA (per RFC 6979) include the private key in the generation of k?

It's clear that using the private ECDSA key $x$ as an additional input into the hash algorithm, as specified in RFC 6979, doesn't harm security (assuming HMAC_DRBG is a PRF). But is it necessary? ...
2
votes
0answers
42 views

Randomization of ECDSA signing operations to prevent SCA

A large number of SCA papers that talk about ECDSA mention the need for blinding/randomisation of the signing process, typically with a single-sentence comment about replacing the projective ...
1
vote
1answer
80 views

Gennaro & Goldfeder Key Generation Protocol

As I am going through the “Fast Multiparty Threshold ECDSA with Fast Trustless Setup” paper by Gennaro & Goldfeder, 2018, I am stumbled by the key generation protocol (Sect. 4.1, p.10): In Phase ...
1
vote
1answer
166 views

Verify that x, y coordinates given as hex string are valid points on an Elliptic Curve [duplicate]

Given the following information: "curve": "P-256", "qx": "729C51D177EBE2079A0FB7B0B3C2145159CF81EC61960E642A1744719AA9F913", "qy": "...
4
votes
1answer
156 views

Can the security of ECDSA be compromised by the chosen parameters?

The recommended parameters for a secp256k1 ECDSA curve are: (All values are in hexadecimal) ...
1
vote
1answer
38 views

Coin tosses in the context of commitment schemes

I was reading the “Fast Multiparty Threshold ECDSA with Fast Trustless Setup” paper by Gennaro & Goldfeder, 2018 and I encountered this portion (Sect. 2.4, p.6): This excerpt leaves me slightly ...
0
votes
0answers
96 views

ECDSA Algorithm

Let the curve $$y^2 = x^3 + 3x+ 5$$ be defined on $Z_{19}$ . If my private key is $d=4$ what is my public key for $P=(9,1)$ . If $H(M)=4$, find your ECDSA signature for message. Randomize the ...
0
votes
0answers
15 views

ECDSA for EUF-CMA [duplicate]

If I want to prove that the ECDSA (secp256k1) on the blockchain belongs to EUF-CMA, is there any relevant knowledge or literature explaining this part?
2
votes
1answer
77 views

Question about IETF RFC6979 determinisitc (EC)DSA document section 3.6 additional data k'

In RFC6979, on page 14, Section 3.6 "Variants": o. Additional data may be added to the input of HMAC, concatenated after bits2octets(H(m)): ...
6
votes
1answer
139 views

Schnorr groups allowing fast modular reduction, vs GNFS

I'm looking for Schnorr groups allowing fast modular reduction. Say, using the notation in DSA, with 256-bit prime $q$ and 3072-bit prime $p$, and $p\equiv1\pmod q$. Are there standards, RFC, or other ...
0
votes
0answers
69 views

An "unsafe" curve over RSA? [duplicate]

I'm implementing a token server and considering backing them with ECDSA. The options from the library I'm using expose the NIST curves P-256, P-384, and P-521. The safe curves site does not list P-521,...
1
vote
0answers
80 views

Security of an ECDSA Adaptor Signature Implementation

I'm currently working on an implementation of ECDSA Adaptor Signatures, and part of the signature scheme calls for a NIZK proof to verify knowledge of exponent over two public keys that share a ...
2
votes
2answers
478 views

Is it OK to use r-value from ECDSA signature (r, s) to prevent replay attack?

ECDSA signatures are malleable. Given a valid signature (r, s), one can create a second valid signature by negating the s value. I have searched workaround for this issue, and https://yondon.blog/2019/...
5
votes
1answer
583 views

What is the Lord of the Ring(s): Side Channel Attack and What are the results

A recent Paper to appear on USENIX Security 2021 titled as Lord of the Ring(s): Side Channel Attacks on the CPU On-Chip Ring Interconnect Are Practical by Riccardo Paccagnella Licheng Luo Christopher ...
0
votes
1answer
156 views

How to compare the time of encryption, cracking and verification elliptic curve problem in the same framework?

everyone! As a beginner, I would like to ask you a question. The best algorithm known for cracking (done by anonymous snooper) this problem (Discrete logarithm problem of elliptic curve or ECDSA)is ...
0
votes
1answer
101 views

Elliptic curve in Binary Field implementation

For Elliptic curves defined over $GF(2^n)$, by adding any two points P and Q over $GF(2^n)$ we get the third point over $GF(2^n)$. In Elliptic Curve Digital Signature Algorithm (ECDSA) https://en....
1
vote
1answer
120 views

How did this group discover m wasn't random?

In this video a group of "hackers" describe how they discovered private keys for the PS3 that was using this ECDSA algorithm by discovering that the "random" integer $m$ (or $k$ in ...
0
votes
0answers
96 views

Guarding against vulnerabilities for a digital signature service (RSA )

Lets's say I have a cipher-module / cryptography-service that signs a hash of some unknown payload. What are the possible attacks that I would need to guard against in this context (primarily assuming ...
1
vote
1answer
125 views

ecdsa nonce reuse to compute the private key, modular inverse question

I am following along some cryptography challenges:, in particular ECDSA Nonce Reuse here (second problem): https://blog.coinbase.com/capture-the-coin-cryptography-category-solutions-fe94d82165c5 I ...
1
vote
1answer
102 views

Security level of DSA when $q$ is a 224 bit prime?

What is the security level of DSA algorithm when $q$ is a 224 bit prime? Is it always a simple rule that the security level is the bit length of $q$ divided by two ?
1
vote
0answers
415 views

Calculating ECDSA Private Key From Multiple Signatures With Shared k (random nonce)

I've been experimenting with ECDSA signatures and with how the Sony PS3 private key was leaked. Specifically where: $$k = \frac{z_1 - z_2}{s_1 - s_2}$$ $$d_A = \frac{z_1s_2 - z_2s_1}{k(s_1 - s_2)}$$ ...
3
votes
0answers
130 views

How can the Number Field Sieve attack the discrete log in $\mathbb Z_p^*$ of DSA?

The Digital Signature Algorithm (DSA) uses $L$-bit prime $p$ and $N$-bit prime $q$ with $q| p-1$, i.e., $p = r\cdot q +1$ ( Schnorr group if $r>2$ and safe prime if $r=2$). In a way, the security ...

1
2 3 4 5
9