Questions tagged [dsa]

The Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. It was proposed by the National Institute of Standards and Technology (NIST) in August 1991 for use in their Digital Signature Standard (DSS), specified in FIPS 186, adopted in 1993. A minor revision was issued in 1996 as FIPS 186-1. The standard was expanded further in 2000 as FIPS 186-2 and again in 2009 as FIPS 186-3.

Filter by
Sorted by
Tagged with
53 votes
2 answers
70k views

Signatures: RSA compared to ECDSA

I'm signing very small messages using RSA, and the signature and public key are added to every message, which requires a lot of space compared to the actual content. I'm considering switching to ...
Maestro's user avatar
  • 1,069
43 votes
2 answers
27k views

How does recovering the public key from an ECDSA signature work?

It is possible to recover the public key from an ECDSA signature values $(r,s)$? Please explain how this works.
Jan Moritz's user avatar
39 votes
1 answer
17k views

ECDSA, EdDSA and ed25519 relationship / compatibility

I'm trying to understand the relationship between those three signature schemes (ECDSA, EdDSA, and ed25519) and mainly to what degree they are mutually compatible in the sense of key-pair derivation, ...
Rafael Korbas's user avatar
36 votes
2 answers
17k views

HMAC vs ECDSA for JWT

I will be implementing JSON web tokens into my website and have a question about implementing them. I have a choice of using two algorithms, HMAC-SHA256 and ECDSA-SHA256. I have used HMAC-SHA256 in ...
user2924127's user avatar
36 votes
4 answers
13k views

Can ECDSA signatures be safely made "deterministic"?

Using the terminology of the ECDSA Wikipedia page, ECDSA (and DSA) signatures require a random k value for each signature which ensures that the signature is different each time even if the message ...
ByteCoin's user avatar
  • 737
32 votes
2 answers
19k views

ECDSA Compressed public key point back to uncompressed public key point

From the ECDH demo here, if I generate a private key for Alice I can get _ P = 1175846487558108474218546536054752289210804601041 Which gives the following public ...
Ian Purton's user avatar
30 votes
1 answer
20k views

How strong is the ECDSA algorithm?

Some cryptographic algorithms are as strong as the size of their key is, while other have some weaknesses that limit their strength (such as SHA-1). How strong is the ECDSA algorithm, and does that ...
ThePiachu's user avatar
  • 1,679
27 votes
2 answers
8k views

Using same keypair for Diffie-Hellman and signing

Are there any security risks using a single key-pair for both key-exchange and signing? I'm mainly interested in using Curve25519 for key-exchange and Ed25519 for signing. But similar combinations, ...
CodesInChaos's user avatar
  • 24.9k
21 votes
1 answer
959 views

How to provide secure "vanity" bitcoin address service?

Bitcoin addresses are RIPEMD-160 hashes of the public portion of a public/private ECDSA keypair (along with an abbreviated hash of the hash to provide a check code, as @pulpspy notes in a comment). ...
nealmcb's user avatar
  • 570
21 votes
1 answer
9k views

Reasons for Chinese SM2 Digital Signature Algorithm

In the IETF RFC draft named "SM2 Digital Signature Algorithm" a signature algorithm is specified. The RFC does however not mention why this signature algorithm has been defined. Nor does it ...
Maarten Bodewes's user avatar
  • 92.6k
20 votes
2 answers
1k views

What is the intuition for ECDSA?

I understand DH and ElGamal and RSA encryption/signatures. But when I look at ECDSA (or plain DSA), it seems like the formulas are just pulled out of thin air. I can verify that the algebra used in ...
Fixee's user avatar
  • 4,158
19 votes
3 answers
2k views

Can deterministic ECDSA be protected against fault attacks?

In a paper by Barenghi and Pelosi, it was described that fault attacks could be used to derive the secret key when using deterministic ECDSA as described in RFC6979 by @Thomas_Pornin Deterministic (...
Yustack's user avatar
  • 361
19 votes
2 answers
12k views

Difference between X25519 vs. Ed25519

I am reading https://en.wikipedia.org/wiki/Curve25519 and it states Also in 2018, RFC 8446 was published as the new Transport Layer Security v1.3 standard. It requires mandatory support for X25519, ...
ams's user avatar
  • 631
19 votes
1 answer
7k views

How does the "biased-$k$ attack" on (EC)DSA work?

I recently stumbled across Thomas Pornin's old answer about deterministic (EC)DSA again. There he states the following: Note that $k$ must be generated uniformly in the $[1, q-1]$ range (where $q$...
SEJPM's user avatar
  • 46k
18 votes
3 answers
3k views

Digital signature that is only verifiable by one specific person

I would like to digitally sign a message in such a way that the signature can only be verified by one specific person. Simply encrypting the signature will not work, because that person could then ...
Jesbus's user avatar
  • 281
18 votes
1 answer
18k views

What is the difference between ECDSA and EdDSA?

As I understand it, both work with elliptic curves, but there seems to be a difference as EdDSA is generally recommended over ECDSA.
Tartori's user avatar
  • 283
17 votes
2 answers
27k views

What curve and key length to use in ECDSA?

I'm developing a client/server system in Java which is not interacting with third-party software, so I don't have to worry about compatibility. At a certain point, I need the client and server to ...
Marcello's user avatar
  • 347
17 votes
2 answers
5k views

Can one reduce the size of ECDSA-like signatures?

Using $n$-bit ECDSA, a signature has a size of $2·n$. It is possible to recover the public key from this signature, which shows that there is a publicly visible redundancy in the signature. Is ...
CodesInChaos's user avatar
  • 24.9k
15 votes
1 answer
25k views

ECDSA Signature R|S to ASN1 DER Encoding question

I am trying to test my understanding on ECDSA Signature r|s to ASN.1 DER Encoding for NIST P-256. I have r|s and when I convert ...
vison's user avatar
  • 163
14 votes
1 answer
6k views

Curve25519 over Ed25519 for key exchange? Why?

I've been reading up on the Signal Protocol (in this PDF) and it seems to be using Curve25519 for ECDH and EdDSA (with Ed25519) for signatures. My question is why not use only Ed25519? This ...
OughtToPrevail's user avatar
14 votes
1 answer
9k views

DSA vs. ElGamal vs. Schnorr

It has been well known for a long time that NSA played a primary role in the development of the Digital Signature Algorithm (DSA). DSA is a sort of hybrid of the ElGamal and Schnorr signature schemes....
Nemo's user avatar
  • 1,377
14 votes
3 answers
10k views

Creating a license system based on asymmetric encryption (RSA or ECDSA)

I’ve spent a couple of days researching the topic of creating a license system for my desktop software. While I fully understand that there’s no perfect copy protection, this approach seems to have ...
CodeX's user avatar
  • 263
14 votes
1 answer
1k views

Making ECDSA public keys one bit shorter

In compressed form, ECDSA public keys are one bit larger than the curve size. There are some situations where this extra bit is extremely inelegant. So I had the following idea as a way to remove it. ...
David Schwartz's user avatar
14 votes
2 answers
6k views

Is it safe to reuse a ECDSA nonce for two signatures if the public keys are different?

We denote the s value of an ECDSA signature $(r, s)$ on a message $m$ as: $s=\frac{H(m)+xr}{k}$ Assume two ECDSA signatures sharing the same nonce $(r, s_1) , (r, s_2)$ on two messages $m_1, m_2$, ...
Ethan Heilman's user avatar
13 votes
1 answer
34k views

How can I convert a DER ECDSA signature to ASN.1?

I having trouble verifying an ECDSA signature signed using client side javascript with Java/BouncyCastle. The javascript signing function source: ...
Ben's user avatar
  • 241
13 votes
2 answers
16k views

Why OpenSSH prefers ECDSA nistp256 keys over -384 and -521, and those over Ed25519, for host key verification?

According to ssh_config(5), HostKeyAlgorithms “specifies the host key algorithms that the client wants to use in order of ...
squirrel's user avatar
  • 331
13 votes
3 answers
27k views

Using ECDSA keys for encryption

I know that ECDSA is used for signature only, but I wonder if I can use the public/private Elliptic Curve keys for encryption too. I have ECDSA SSH public keys and I wonder if I can use them to ...
jcea's user avatar
  • 343
12 votes
2 answers
8k views

Are there any Secp256k1 ECDSA test examples available?

Are there any available test cases for testing elliptic curves like secp256k1 (Korblitz curves from http://www.secg.org/collateral/sec2_final.pdf)? For curves like P192 there are for example those ...
ThePiachu's user avatar
  • 1,679
12 votes
3 answers
20k views

Why can’t DSA be used for encryption?

This question at StackOverflow mentions that DSA cannot be used for encryption. But both RSA and DSA can be used to generate public and private keys, right? Then why can't I use the DSA public key to ...
Lunar Mushrooms's user avatar
12 votes
1 answer
4k views

What signature schemes allow recovering the public key from a signature?

It seems to be possible to retrieve the (public) key used for creating an ECDSA signature just from the signature alone. This seems like an interesting property; as far as I know, RSA doesn't share ...
lxgr's user avatar
  • 1,798
12 votes
1 answer
3k views

RFC 6979 - Why not simply hash the message & the private key for deterministic ECDSA?

Why go through the trouble of using the HMAC_DRBG process, instead of simply hashing [message | private key] to calculate $k$ for deterministic ECDSA? If the ...
thera's user avatar
  • 346
11 votes
1 answer
1k views

Are DSA and ECDSA provably secure assuming DL security?

Is there proof that the DSA construction, also used by ECDSA, is secure assuming that discrete logarithms in the relevant group representation are difficult?
Myria's user avatar
  • 2,575
11 votes
1 answer
5k views

ECDSA vs RSA: Performance on Android platform and surprising results

For our privacy-preserving protocol, an encrypted channel is established. In order to protect our system from man-in-the-middle attacks, a signature-based approach is used. After we've implemented it ...
OnTarget's user avatar
  • 453
11 votes
1 answer
2k views

(EC)DSA signature without hashing, or with offloaded hash?

In (EC)DSA as per FIPS 186-4, the message to sign is first hashed. Imagine that we skip this hashing stage, instead put the message where the hash was, and constrain the size of message $h$ to the ...
fgrieu's user avatar
  • 141k
10 votes
4 answers
4k views

What is the signature scheme with the fastest batch verification protocol for multiple signers?

I'm looking for a scheme where signing may be costly (slow) but batch verification with different signers is the fastest possible. Modified ECDSA allows batch verification for different signers with ...
SDL's user avatar
  • 1,867
10 votes
1 answer
694 views

Why use $(r,s)$ instead of $(r,s^{-1})$ as DSA signature?

A DSA signature consists of two scalars $(r,s)$. When signing $s$ is generated as: $s=k^{-1}(H(m)+xr) \mod q$ The signature is $(r,s)$ When verifying $s$ is only used to compute $w = s^{-1}$. So ...
CodesInChaos's user avatar
  • 24.9k
10 votes
1 answer
3k views

Why are MACs in general deterministic, whereas digital signature constructions are randomized?

The fact is I'm not quite sure if my question statement is true, however all the MAC constructions I know of (e.g. CBC-MAC, CMAC, HMAC) are deterministic, whereas many constructions for digital ...
MartinSuecia's user avatar
  • 2,450
10 votes
1 answer
1k views

When to use safe prime or Schnorr group

Protocols that use $\mathbb{Z}_{p}^*$ arithmetic often choose $p$ to be a safe prime ($p = 2q + 1$, for prime $q$) or to have the Schnorr group form ($p = rq + 1$, for prime $q$). I understand that ...
Conrado's user avatar
  • 6,424
10 votes
1 answer
3k views

Performance of ECDSA, ECKCDSA and ECGDSA

It is proven that ECDSA algorithms are faster in key and signature generation compared to RSA. In addition, the signatures are much shorter. However, I would like to know the performance difference ...
budderick's user avatar
  • 425
9 votes
1 answer
11k views

How do RSA and ECDSA differ in signing performance?

Signature algorithms with elliptic curves have smaller output sizes compared to RSA for the same level of security. What about the processing time to generate a signature ? I've seen figures giving ...
Dingo13's user avatar
  • 2,867
9 votes
2 answers
740 views

What is TPMFail attack and what are the countermeasures?

Trusted Platform Module (TPM) is designed as a hardware-based root of trust to protect cryptographic keys even against system based adversaries. Although Intel's firmware based fTPM has FIPS 140-2 ...
kelalaka's user avatar
  • 48.5k
9 votes
1 answer
18k views

What is the recommended minimum key length for ECDSA signature

I want to identify the proportion of certificates that use unrecommend ECDSA key length for TLS certificates based on some data I collected. By looking at a standard like NIST for example, I find ...
user9371654's user avatar
9 votes
1 answer
2k views

Is it possible to decrypt an ECDSA private key if the same nonce is used across different private keys?

If the same nonce is used across different messages under the same private key, the private key can be easily revealed. However, let's consider another scenario. Two private keys, x1 and x2, are ...
Anonymous's user avatar
  • 153
9 votes
2 answers
6k views

Complete Set of Test-Vectors for ECDSA secp256k1

Although there are several implementations of ECDSA secp256k1 public available over the internet (the most popular being OpenSSL), it seems that there are no complete set of test-vectors available. ...
Mark Messa's user avatar
9 votes
1 answer
2k views

Simple digital signature example that one could compute without a computer?

I am working on a document to explain Bitcoin to students. But I am having a hard time translating the principle described in §2 of the Bitcoin whitepaper in layman's terms. There is a great question ...
Bob van Luijt's user avatar
8 votes
1 answer
10k views

Should I use RSA encryption since RSA is said to be broken by NSA?

I am developing a simple web app that uses asymmetric encryption, but I am not sure whether to chose RSA for the reasons mentioned above. What are your suggestions? Also if I decided to go with RSA ...
john doe's user avatar
  • 113
8 votes
2 answers
2k views

How is the x coordinate of a "point at infinity" encoded in a Secp256k1 signature?

I'm testing an implementation of Bitcoin, which uses the curve Secp256k1 for ECDSA, and I want to see how it handles the point at infinity ($0$) if present in a signature. For example, r could be the ...
SDL's user avatar
  • 1,867
8 votes
1 answer
472 views

Elliptic Curve Cryptography - When to use p and when to use n

Im currently playing around with ECC, in particular the ECDSA scheme on a brainpool P256R1 curve. While implementing the signature verification function, I've stumbled upon a few problems. So far I'...
TrinityTonic's user avatar
8 votes
2 answers
2k views

Given a message and signature, find a public key that makes the signature valid (ECDSA)

This question is a variant on Given a message and signature, find a public key that makes the signature valid, which discusses the analogous question for RSA. It was suggested to me by this post over ...
Nate Eldredge's user avatar
8 votes
1 answer
789 views

preferred method for generating k for DSA / ECDSA

FIPS 186-4, sections B.2.1 and B.2.2, discuss two different methods for generating k for DSA / ECDSA. Unless I'm mistaken RFC 6979 discusses another method utilizing HMAC_DRBG. So what method is the ...
neubert's user avatar
  • 2,927

1
2 3 4 5
11