Questions tagged [dsa]

The Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. It was proposed by the National Institute of Standards and Technology (NIST) in August 1991 for use in their Digital Signature Standard (DSS), specified in FIPS 186, adopted in 1993. A minor revision was issued in 1996 as FIPS 186-1. The standard was expanded further in 2000 as FIPS 186-2 and again in 2009 as FIPS 186-3.

Filter by
Sorted by
Tagged with
0
votes
1answer
390 views

Why are cryptographically secure hashes required for digital signing (RSA or DSA)?

I know that a cryptographically secure hashing algorithm is required for proper message signing (SHA-1, or I think SHA-2 is the current suggested algorithm). However, why does the hashing algorithm ...
3
votes
3answers
539 views

Verifying DER encoded DSA/ECDSA signature with extra content?

Having a DSA/ECDSA signature which is supposed to be DER encoded as an ASN.1 sequence of $r$ and $s$ (as described in the RFC), and being given some bytes which are ...
4
votes
1answer
3k views

Why is 224 bit ecdsa faster than 192 bit ecdsa?

I ran several benchmarks using openssl on 2 different computers and I got a surprising result. for the Nist 192 bit curve the benchmark result is ...
0
votes
1answer
169 views

How to calculate kinv from the given k value

I am implementing an ECDSA NIST test vectors verification application. The test vectors are taken from http://csrc.nist.gov/groups/STM/cavp/#09. One of the test vectors is given below: ...
5
votes
1answer
876 views

Storage of Private Keys

I'm building a bitcoin web application that will require all users to be assigned a wallet for adding funds to their account. I plan on exposing the public key to the user (the bitcoin address). Users ...
2
votes
1answer
508 views

Can Secp 256 K1 curves “map” to a value on FIPS 186-3 or P-256?

I'm looking at Secp 256K1 vs UProve's FIPS 186-3 or P-256 implementation. Is there any relationship between the curves such that I can consistently "map" or "project" values from one curve to another?...
4
votes
1answer
891 views

Can $r$ and $s$ from an ECDSA signature be negative numbers?

I have an ECDSA implementation in Mathematica over secp256k1 and $r$ and $s$ are always positive numbers. But if you encode them as bytes, the most significant byte can be over ...
10
votes
1answer
2k views

Why are MACs in general deterministic, whereas digital signature constructions are randomized?

The fact is I'm not quite sure if my question statement is true, however all the MAC constructions I know of (e.g. CBC-MAC, CMAC, HMAC) are deterministic, whereas many constructions for digital ...
4
votes
2answers
12k views

ECDSA with SHA256 and sepc192r1 curve: Impossible, or how to calculate $e$?

I need to use ECDSA as the signing algorithm and SHA256 for hashing the message. I'm running into troubles verifying the signature calculated on two different platform (one is BouncyCastle, another ...
2
votes
1answer
89 views

Validity of authentication scheme?

Here's an authentication scheme I had in mind that combines the simplicity of HTTP Digest Authentication and the security of real crypto primitives. I have in mind the user-level authentication, ie ...
1
vote
0answers
63 views

Minimum length of PKI key for signature [duplicate]

I am looking for data which shows how time it would take to brute force (or crack by any other method) different sizes of RSA/DSA keys used for a digital signature. I am looking to use as small a ...
1
vote
1answer
662 views

ECDSA: Retrieving non-random k [duplicate]

I have a question regarding the random $k$ number of ECDSA encryption. As far as I know, it is possible to retrieve $k$ (and thus the private key) from two signed messages if both used the same $k$. ...
5
votes
1answer
3k views

ECDSA: How to retrieve a non-random k

I have a question regarding the random $k$ number of ECDSA encryption. As far as I know, it is possible to retrieve $k$ (and thus the private key) from two signed messages if both used the same $k$. ...
2
votes
1answer
456 views

Given p and q of DSA how do you show they are prime?

I am given p = 4916335901 q = 88903 and am asked to show these are prime as well as q|(p-1) in DSA. I am unsure on how to ...
2
votes
1answer
3k views

How (in)secure is a signature based on DSA with DSS1 (SHA1) in reality?

As I found out the OpenSSL implementation provided by PHP (openssl_sign) only allows DSS1 as the hashing algorithm for DSA signatures (see also my related question). I’d prefer DSA over RSA in my ...
9
votes
1answer
4k views

ECDSA vs RSA: Performance on Android platform and surprising results

For our privacy-preserving protocol, an encrypted channel is established. In order to protect our system from man-in-the-middle attacks, signature-based approach is used. After we've implemented it ...
2
votes
1answer
927 views

ECDSA Public Key generation

Referring to both Wikipedia page and ECDSA-cert paper I can understand that, given $\mathcal{E} = \mathcal{E}(a,\,b,\,\mathbb{F}_{2^m})$ as our elliptic curve on $\mathbb{F}_{2^m}$ group $G \in \...
2
votes
1answer
602 views

Generate a new public/private key pair for each new message?

When using PGP type public encrypted communication, would it be a good idea to generate a new public for each message and attach that in the new public key in the reply to back to sender mail body? ...
9
votes
1answer
25k views

How can I convert a DER ECDSA signature to ASN.1?

I having trouble verifying an ECDSA signature signed using client side javascript with Java/BouncyCastle. The javascript signing function source: ...
3
votes
1answer
2k views

Why the need to hash before signing small data?

I’ve got two questions: I’m doing the following: Data : uuid + int + nonce Signature: ECDSA(sha256(Data) ) To verify the signature: ...
7
votes
1answer
630 views

Is it possible to weaken a bitcoin private key by “using” it elsewhere?

What are the increased possibilities (if any) of being able to crack a private key given the following: The associated bitcoin (ECDSA Secp256k1-based) public key is known. The private key has been ...
0
votes
0answers
39 views

Is it possible to weaken a bitcoin private key by 'using' it elsewhere? [duplicate]

What are the increased possibilities (if any) of being able to crack a private key given the following: The associated bitcoin (ECDSA Secp256k1-based) public key is known. The private key has been ...
2
votes
0answers
574 views

Is this a secure (and correct) sign-then-encrypt technique for transferring messages?

After reading some information on the way iMessage works I have been working on writing some code to try my hand at securely transferring messages in a similar manner and I wanted to confirm that the ...
6
votes
1answer
441 views

Should different key pairs be used for signing and encryption?

In the recent iOS Security white paper from Apple (February 2014), the section on iMessage discusses using two different asymmetric key types as part of its standard operation: When a user turns on ...
2
votes
1answer
414 views

Verifying multiplicative inverse on a prime field in NIST's ECDSA_Prime.pdf

I am trying to learn about the Elliptic Curve Digital Signature Algorithm (ECDSA) by verifying the results in some example calculations. I found a PDF of example ECDSA calculations from NIST here: ...
3
votes
1answer
122 views

Signing the hash of a key with the same key

Given a private signature key sk and a public signature key SK, does revealing sk(H(SK)) (in ...
0
votes
2answers
309 views

Why does DSS have such formulas?

I've learnt the formulas needed for the DSA (http://en.wikipedia.org/wiki/Digital_Signature_Algorithm). But most importantly, I don't quite understand what represents those formulas and why they are ...
2
votes
0answers
608 views

Where can I find examples of ECC implemented in VHDL?

I am looking into implementing ECDSA signature and ECDH key agreement in a Xilinx FPGA. All the examples I have found of VHDL implementations skip over how to construct the low level ECC primitives (...
3
votes
1answer
4k views

Signature algorithm SHA 1-2 with ECDSA

Can someone please explain what key sizes are required for the ECDSA algorithm? I tried a 128 bit EC Key for SHA1withECDSA and it throws an error. However with 256 bit key I could run the algorithm. ...
2
votes
1answer
288 views

Verify Messages to Embedded Device

I'm building an embedded device that I plan on distributing. Periodically the device will poll my server to check for updates and commands. I'd like the device to verify that any messages(JSON strings ...
5
votes
2answers
443 views

Isn't the deterministic property of (EC)DSA a security problem?

From what I read in Wikipedia's article "Elliptic Curve DSA ~ Security", the "deterministic" generation of $k$ can help prevent certain type of attacks (such as the one happened to Sony). However, ...
2
votes
1answer
2k views

Where can I find Secp256k1 ECDSA test vectors?

I`m currently implementing an ECDSA library based on curves like secp256k1. I would like to test it using some test vectors, like http://csrc.nist.gov/groups/STM/cavp/documents/dss/ecdsatestvectors....
4
votes
1answer
564 views

How to properly add ECDSA private keys?

I'm currently working on an application that requires me to add two ECDSA private keys in order to make a new private key. The result has to have the property, that its corresponding public key is the ...
2
votes
1answer
894 views

Is using Ed25519 parameters in ECDSA safe?

I recently discovered the Curve25519 key exchange lib and the Ed25519 signature lib. Due to the speculations about NIST-designed curves, there is a chance that I ditch them and use the curves above ...
1
vote
1answer
382 views

ECDSA - point order criterion

i am creating some primitive demostration for ECDSA over small curve (p < 229). But my implementation have some weird issues. Verify process return false even if the signature is correct. Because I ...
8
votes
2answers
1k views

How is the x coordinate of a “point at infinity” encoded in a Secp256k1 signature?

I'm testing an implementation of Bitcoin, which uses the curve Secp256k1 for ECDSA, and I want to see how it handles the point at infinity ($0$) if present in a signature. For example, r could be the ...
2
votes
1answer
483 views

Can A PRNG Be Used To Generate Multiple Private Keys for ECDSA?

Suppose Alice seeds a cryptographically strong Pseudo Random Number Generator with a truly random number, and keeps it secret. Alice then uses the output of the PRNG to generate several 256-bit ...
0
votes
1answer
1k views

DSA generate signature and verify

I'm trying to generate a signature for DSA with the following parameters: $p = 23$ , $q = 11$ , $g = 3$ , $H(m) = 8$ , $x = 5$ for the life of me, I cannot choose a random $k$ ($0 > k > q$) ...
4
votes
2answers
492 views

Using single EC cert/keying material to derive symmetric encryption key (for storage)?

The situation involves a single party (single certificate) who would want to AES encrypt a file that they can later decrypt. Assume the EC certificate + EC keys have a purpose i.e. "File encryption" (...
10
votes
1answer
2k views

What signature schemes allow recovering the public key from a signature?

It seems to be possible to retrieve the (public) key used for creating an ECDSA signature just from the signature alone. This seems like an interesting property; as far as I know, RSA doesn't share ...
27
votes
1answer
18k views

How strong is the ECDSA algorithm?

Some cryptographic algorithms are as strong as the size of their key is, while other have some weaknesses that limit their strength (such as SHA-1). How strong is the ECDSA algorithm, and does that ...
6
votes
2answers
803 views

Is there any weak message for an ECDSA signature?

Suppose ECDSA is used without hashing the message, but directly using a short message (say 10-bytes long) as the value z (using the definitions at http://en....
4
votes
1answer
325 views

How can I tell which curve a given ECDSA implementation uses? (P-521 or something else)

I'd like to test and see if certain software uses P-521 ECC curves, or if it uses another variant. Without having access to the sourcecode, or the specification, is there any way for me to test which ...
4
votes
1answer
264 views

Length of data to hash for PGP

I have finally managed to verify some simple PGP signed message blocks. However, I discovered that for some reason, my implementation limits me to verifying data that is 9-16 bytes long. no less. no ...
1
vote
2answers
315 views

Is there a problem with this non-ECDSA message signing?

Is there a problem with signing a message like this? ...
2
votes
2answers
1k views

DSA, RSA, ECDSA etc - which one is cheapest for signing?

For a protocol where the server presents its signature to prove authenticity (e.g. IKE/SIGMA/STS with only one party authenticated), it's essential that the signing is extremely cheap, while ...
5
votes
1answer
1k views

In ECDSA, how many field operations are used for signature verification?

I am wondering about the computational cost of ECDSA signature verification, in term of multiplications in the base field; and, as an aside, in term of (much cheaper) additions. To make things ...
9
votes
1answer
524 views

Why use $(r,s)$ instead of $(r,s^{-1})$ as DSA signature?

A DSA signature consists of two scalars $(r,s)$. When signing $s$ is generated as: $s=k^{-1}(H(m)+xr) \mod q$ The signature is $(r,s)$ When verifying $s$ is only used to compute $w = s^{-1}$. So ...
2
votes
1answer
678 views

Why is verification using DSA slower than verification with RSA?

We read in literature that verification of a digital signature is slower using DSA than if we used RSA. Why is this? DSA parameter generation: choose prime number $p$ choose prime number $q$ such ...
4
votes
2answers
1k views

DSA signatures with related k and unknown payloads

Suppose that we are given DSA parameters $p$, $q$, $g$, a public key $y = g^x$, and two signatures $(r_1,s_1)$ and $(r_2,s_2)$. We are told that $(r_1,s_1)$ and $(r_2,s_2)$ were produced by related ...

1
4 5 6
7
8