Questions tagged [dsa]

The Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. It was proposed by the National Institute of Standards and Technology (NIST) in August 1991 for use in their Digital Signature Standard (DSS), specified in FIPS 186, adopted in 1993. A minor revision was issued in 1996 as FIPS 186-1. The standard was expanded further in 2000 as FIPS 186-2 and again in 2009 as FIPS 186-3.

Filter by
Sorted by
Tagged with
11
votes
1answer
910 views

(EC)DSA signature without hashing, or with offloaded hash?

In (EC)DSA as per FIPS 186-4, the message to sign is first hashed. Imagine that we skip this hashing stage, instead put the message where the hash was, and constrain the size of message $h$ to the ...
7
votes
1answer
2k views

ECDSA security using same per-message secrets $k$ but different signing keys

I know that when I have a ECDSA keypair and use it twice with the same $k$ to sign different messages then the private key can be recovered. If I now have multiple ECDSA keypairs and sign a message ...
2
votes
1answer
675 views

Why can ECDSA public keys be sent over an insecure network, while ECDSA is used to sign ECDH public keys to securely be transported over the network?

Basically the title says it all. I am trying to develop and understand an ECDH-ECDSA encryption. My current approach to provide some form of authentication to the ECDH is to use ECDSA to sign the ...
5
votes
2answers
377 views

Is DSA vulnerable if verifier doesn't check r' > 0?

If a DSA implementation neglects to check $r' > 0$ when verifying signatures, what are the consequences? Creating a forged $s$ would seem to require solving for $k$ $g^k mod\ p = nq$ which is ...
1
vote
1answer
555 views

Challenge Response at Application Layer of BLE using ECDSA

There is a need for an Offline BLE device to Auth a Phone. I am planning to use challenge response somewhat outlined here. There is a small change. Instead of shared secret. I am planning to use a ...
3
votes
1answer
214 views

Why do people worry about the exceptional procedure attack if it is not relevant to ECDSA?

The exception procedure attack is described here: https://www.iacr.org/archive/pkc2003/25670224/25670224.pdf People are afraid of this attack, because it could leak information on the private key in ...
3
votes
1answer
200 views

Can ECC correctness issues allow “remote attackers to spoof ECDSA signatures”?

CVE-2015-2730: Mozilla Network Security Services (NSS) before 3.19.1, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and other products, does not properly ...
7
votes
1answer
617 views

Goofs that could creep in ECDSA signature verification?

What are goofs that could creep in ECDSA signature verification, perhaps with focus on curves based on prime-order $\mathbb Z_p$, specifically P-256 aka secp256r1? Is it possible to construct test ...
0
votes
1answer
250 views

ECDSA Verification - Last Steps

Reaching the end of an ECDSA signature verification, we need to compute multiple point multiplication and addition as following: $R=(x_R, y_R) = u_1G + u_2Q$, where $u_1$ and $u_2$ are scalars, $G$ is ...
6
votes
1answer
275 views

Elliptic Curve Cryptography - When to use p and when to use n

Im currently playing around with ECC, in particular the ECDSA scheme on a brainpool P256R1 curve. While implementing the signature verification function, I've stumbled upon a few problems. So far I'...
1
vote
1answer
5k views

Length of ECDSA signature

I am using "secp192k1" curve to generate the key for data signing using ECDSA scheme. Signature is generated using "SHA3-256withECDSA" algorithm provided by BouncyCastle. Theoretically, the length of ...
2
votes
1answer
444 views

Is there parameter recommendation of DSA or RSA?

I know there are recommendations of elliptic curve parameters (such as NIST P-xxx). Are there recommendations of DSA (or DLP such as Schnorr signature) or RSA parameters? If not, why?
2
votes
1answer
550 views

Cipher suite priority

I've been tasked with defining a list of cipher suites to use. The requirements for the cipher suites are the following: Symmetric Algorithm: AES-256 Key Exchange: ECDH P-384, DH 3072-bit, RSA ...
0
votes
1answer
977 views

In ECDSA, without knowing private key and any signature one can sign random garbage (from the Cryptography list)

Taken from the Cryptography mailing list. It is claimed that in ECDSA, without knowing the private key and any message signed with it, one can sign: "random garbage" (there is some complicated ...
0
votes
1answer
237 views

Signature operations may leak the private key; signature verification should be safe?

What does this warning mean: Signature operations may leak the private key. Signature verification should be safe. A haskell cryto library displays the quoted warning above (see Crypto.PubKey.ECC....
5
votes
2answers
776 views

Are there public $p$ and $q$ numbers for use in DSA?

There are many RFC documents giving large primes to use in Diffie-Hellman. However, I couldn't find standards on the $p$ and $q$ large primes used in the DSA signature scheme. This is proving to be a ...
0
votes
1answer
128 views

Sign + ETM in ECIES

Using ECIES in a file encryption protocol, I need to authenticate the sender, so I'm using ECDSA, and I'm wondering if signing the ephemeral public key(needed by receiver to derive the shared ...
7
votes
1answer
536 views

preferred method for generating k for DSA / ECDSA

FIPS 186-4, sections B.2.1 and B.2.2, discuss two different methods for generating k for DSA / ECDSA. Unless I'm mistaken RFC 6979 discusses another method utilizing HMAC_DRBG. So what method is the ...
3
votes
1answer
602 views

How to sign different messages using deterministic ECDSA?

The elliptic JavaScript library implements a .sign function which seems to give the same result when signing the same message. That means the ...
9
votes
1answer
2k views

Simple digital signature example that one could compute without a computer?

I am working on a document to explain Bitcoin to students. But I am having a hard time translating the principle described in §2 of the Bitcoin whitepaper in layman's terms. There is a great question ...
1
vote
1answer
457 views

DH Key exchange attack: bad choice of g

In the group $\mathbb{F}_p^*$, Bob reads Alice's parameters as $p=234917$ and $g=281$ and uses a secret key $b < 400$ such that $h_b = g^b = 92646$. Note that $p-1 = 2^2\cdot 11\cdot19\cdot281$ $...
2
votes
1answer
1k views

ECDSA pubkey recovery issue

I try to recover public key from the given message $m$ and pair $(r, s)$ using curve that satisfies standard RFC7091. I am using algorithm from one of secp256k1 implementation but it seems that not ...
15
votes
2answers
19k views

What curve and key length to use in ECDSA?

I'm developing a client/server system in Java which is not interacting with third party software, so I don't have to worry about compatibility. At a certain point, I need the client and server to ...
6
votes
1answer
8k views

Should I use RSA encryption since RSA is said to be broken by NSA?

I am developing a simple web app that uses asymmetric encryption, but I am not sure whether to chose RSA for the reasons mentioned above. What are your suggestions? Also if I decided to go with RSA ...
4
votes
2answers
2k views

Is there any reason to use RSA or DSA when we have ECC?

I am having trouble coming up with a use case for RSA or DSA. It appears that ECC is better in every way. Is this true? I am looking for cases where RSA/DSA is superior to ECC, not where it is used ...
1
vote
1answer
235 views

Finding public key out of ECDSA certificate

I got an ECDSA certificate and now I'm trying to find out the public key. I'm not very familiar with this topic, so I hope you bear my (maybe silly question). The reason I'm doing this is, because my ...
5
votes
3answers
525 views

Why R value in signatures have to be 'calculated' values and not just a random numbers?

This document (page 27) says that: The only significant difference between ECDSA and DSA is in the generation of $r$. ECDSA $r = (kG)_x \bmod n$ and, DSA: $r=g^k \bmod p$ Why is it necessary to ...
2
votes
1answer
712 views

Calculating random number in ECDSA based on private key and signature

In ECDSA (Elliptic Curve Digital Signature Algorithm) we use a random number k in the signature process. Signature in ECDSA is: $$ (x_1,y_1) = k * G $$ $$r = x_1 \...
3
votes
1answer
385 views

How do I generate a challenge for elliptic curve signing using NIST standards?

Basically, NIST FIPS 186-4 describes a standard for generating some message that will be signed by an elliptic curve private key. However, I'm having difficulty interpreting how this message should ...
2
votes
1answer
248 views

Time efficiency of Bitcoin Multi-signature Vs. threshold signature

I read this paper (Securing Bitcoin wallets via a new DSA/ECDSA threshold signature scheme) that illustrated that threshold signature is the best solution to avoid single point of failure but I think ...
3
votes
1answer
1k views

Why does DSA require that a new $k$ be chosen and the algorithm restarted if $s=0$?

DSA is an algorithm used to generate a digital signature, which consists of a pair of values $(r,s)$. The algorithm computes $r$ first and then $s$. However, if we calculate $s=0$, it says to restart ...
1
vote
0answers
945 views

Diffie-Hellman combined with DSA/RSA

we have learned Diffie-Hellman, RSA and DSA (Digital Signature Algorithm) in university. Because DH is vulnerable of Man-in-the-Middle we had the task to program the DH combined with RSA to protect ...
0
votes
1answer
577 views

Comparison Affine Coordinates and Projective Coordinates Addition in Excel

Kurve : EC : $y^2=x^3 + x + 1$ Generator:$(1,7)$ $p=23$ Result in Affine use Excel: $P=(1,7)$, $Q=(7,11) \implies P+Q=(18,20)$ Result in Projective use Excel: $P=(1:7:1), Q=(7:11:1) \implies P+Q=(15:...
1
vote
1answer
3k views

ECDSA non random k - Retrieve private key [closed]

At the moment I'm playing around with ECDSA. I know that I can retrieve the private key if the same K is used to sign two messages. I tried to use this script: Ruby Script to crack the private key. ...
5
votes
1answer
559 views

ECDSA key recovery - floating point values

I'm currently attempting to recover an ECDSA key. I have $m$, $m'$ and signatures $(r, s)$, $(r', s')$, and I know that $k$ is constant, the curve is NIST P-192 and the hash function of the. As such,...
7
votes
1answer
279 views

Are there security issues with discrete logarithm keys not being uniformly distributed?

Generally, algorithms based on discrete logarithm specify that private keys are chosen as scalars between 1 and the order of the group (denoted $q$ here). For instance IEEE P1363 and FIPS 186-3 both ...
2
votes
1answer
167 views

Why is DSA falling out of favor?

Windows abandoned DSA rather than extend it to support > 1024 bits; but otherwise I cannot find a reason why DSA would be less desirable. I see in SSH the disabling it by default with a completely ...
0
votes
2answers
134 views

Stripping off message authentication or signature

If attackers can strip off RSA / EC / -DSA digital signature and conduct CCA on AES-CTR or CBC payload, why can't they do the same for AES-GCM?
1
vote
1answer
705 views

Does OpenSSL apply ASN1 encoding to the hash before signing using ECDSA?

I read on stack overflow that OpenSSL performs ASN1 encoding to the hash before signing it for, for ECDSA. In other words, OpenSSL performs the following steps when for an Elliptic curve key ...
8
votes
0answers
124 views

Software timing attack using Kocher method

What's the minimum number of random sample points needed in Kocher's timing attack, so that we can determine enough valid measurements of $A_{i,r}$ and $D_{i,r}$? I'm working from this paper: Volker ...
1
vote
1answer
586 views

Better security than SHA1 for signature?

An application that I maintain uses Sparkle Update to update itself. I expect attacks from high level attackers (China, USA's NSA, etc.) and have some questions about how secure the cryptography ...
3
votes
1answer
3k views

Shouldn't a signature using ECDSA be exactly 96 bytes, not 102 or 103?

Attempting to use openssl to create a signature is confusing on several levels: If I'm using it to sign a hash that I've already created (HMAC-SHA-384-192, specifically), a. why must I specify ...
1
vote
1answer
2k views

How can a lattice attack be applied to ECDSA signatures?

The aim is to check if it is possible to break the ECDSA cryptosystem under the following criteria. Suppose that each ECDSA signature is generated by using the GLV method for point multiplication (...
7
votes
2answers
985 views

ECDSA signature verifiable 1-way transformations

Alice signs a message $m$ with her private key, yielding a signature ($r$,$s$). I want to prove to someone else that I have this signature, but I don't want them to have the knowledge of what ($r$,$s$...
3
votes
1answer
107 views

What is the correct name for bytes which are to be signed?

I have some bytes, and I sign them with my private key using ECDSA. The resultant (71) bytes are the signature. But what is the name of the bytes I have signed? (If this were encryption, they would ...
0
votes
1answer
812 views

SHA1 collisions and the impact for ECDSA signatures

What will it mean for ECDSA using SHA1 when we have practical attacks breaking the collision resistance property of SHA1? [UPDATE] Added a bit more details to be clear. If $(r,s)$ is the ECDSA ...
26
votes
1answer
13k views

ECDSA Compressed public key point back to uncompressed public key point

From the ECDH demo here, if I generate a private key for Alice I can get _ P = 1175846487558108474218546536054752289210804601041 Which gives the following public ...
4
votes
2answers
235 views

Are low security curves for ECDSA not supported?

I am working in a very bandwidth restricted environment, and we are looking to implement ECDSA digital signatures. Although they are no longer recommended, we might be looking to use curves that are ...
2
votes
1answer
1k views

Can I shorten the large ECDSA public key output file from OpenSSL?

I am working in a very bandwidth restricted environment where I from time to time have the need to distribute public keys. The distribution happens in bit format, so there is no need for encoding, at ...
0
votes
0answers
38 views

Are the ECDSA public keys of a stable/fixed length relative to curve size? [duplicate]

I am working in an environment with strict bandwidth requirements, and we need predictable bit lengths of the stuff we send. We need to broadcast ECDSA public keys, and we are using OpenSSL to ...

1
4
5
6 7 8