Questions tagged [dsa]
The Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. It was proposed by the National Institute of Standards and Technology (NIST) in August 1991 for use in their Digital Signature Standard (DSS), specified in FIPS 186, adopted in 1993. A minor revision was issued in 1996 as FIPS 186-1. The standard was expanded further in 2000 as FIPS 186-2 and again in 2009 as FIPS 186-3.
94
questions
9
votes
1
answer
11k
views
How do RSA and ECDSA differ in signing performance?
Signature algorithms with elliptic curves have smaller output sizes compared to RSA for the same level of security.
What about the processing time to generate a signature ?
I've seen figures giving ...
- 2,887
9
votes
1
answer
2k
views
Simple digital signature example that one could compute without a computer?
I am working on a document to explain Bitcoin to students. But I am having a hard time translating the principle described in §2 of the Bitcoin whitepaper in layman's terms.
There is a great question ...
- 207
8
votes
1
answer
808
views
preferred method for generating k for DSA / ECDSA
FIPS 186-4, sections B.2.1 and B.2.2, discuss two different methods for generating k for DSA / ECDSA. Unless I'm mistaken RFC 6979 discusses another method utilizing HMAC_DRBG.
So what method is the ...
- 2,959
8
votes
1
answer
2k
views
EdDSA (Ed25519) is any random number sufficient for a good private key?
Looking at a reference implementation it shows that the key pair generation simply does: read X bytes from RNG and then derive another value from these X bytes thus producing private key with derived ...
- 227
7
votes
1
answer
3k
views
ECDSA security using same per-message secrets $k$ but different signing keys
I know that when I have a ECDSA keypair and use it twice with the same $k$ to sign different messages then the private key can be recovered.
If I now have multiple ECDSA keypairs and sign a message ...
- 213
6
votes
1
answer
12k
views
Public-key format for ECDSA as in FIPS 186-4?
What is the public-key format for ECDSA as in FIPS 186-4, and where is it formally defined?
In particular, are there variants beyond Cartesian coordinates? Is that a pair of bitstrings, or a ...
- 144k
6
votes
1
answer
2k
views
Threshold Signatures for RSA and DSA
I have a few questions relating to threshold signatures: a scheme where $n$ participants hold a key share and any $t$ of them can conduct a protocol using their shares that results in a valid RSA or ...
- 8,697
6
votes
1
answer
818
views
How to properly add ECDSA private keys?
I'm currently working on an application that requires me to add two ECDSA private keys in order to make a new private key. The result has to have the property, that its corresponding public key is the ...
- 1,679
6
votes
2
answers
2k
views
Are curve secp256k1 ECDSA signatures distinguishable from random data?
Are the 64-byte curve secp256k1 ECDSA signatures distinguishable from random data?
I.e. Given a random private key and random data, will there be patterns?
Is there a proof or reasoning for this?
- 958
5
votes
0
answers
353
views
What public-key encryption protocol can use the same key pair as ECDSA?
Assume we wanted to use the same ECDSA public/private key pair (drawn for standard ECC parameters, perhaps P-256) for both its intended use (public-key signature), and for public-key encryption; this ...
- 144k
5
votes
1
answer
163
views
Consequence of improper validation in point decompression?
Assume a standard ECC curve in a prime field $\mathbb F_p$ with $p\equiv3\pmod 4$, such as secp256k1; and code turning a bytestring for a compressed ECC public key into an Elliptic Curve point, that ...
- 144k
5
votes
1
answer
95
views
Securely derive multiple EC keys from master EC key and prove it
Alice has master EC key pair: $a$ - private key, $A$ - corresponding public key
Bob generates 2 random integers $r_1$ and $r_2$ and wants Alice to derive 2 new key pairs:
$a_1$ = $a$ + $r_1$ and $a_2$ ...
- 149
5
votes
2
answers
4k
views
Is there any reason to use RSA or DSA when we have ECC?
I am having trouble coming up with a use case for RSA or DSA. It appears that ECC is better in every way.
Is this true?
I am looking for cases where RSA/DSA is superior to ECC, not where it is used ...
- 4,813
5
votes
1
answer
1k
views
In ECDSA, how many field operations are used for signature verification?
I am wondering about the computational cost of ECDSA signature verification, in term of multiplications in the base field; and, as an aside, in term of (much cheaper) additions. To make things ...
- 144k
4
votes
2
answers
945
views
ECIES with ECDSA
I understand how ECIES work. I have a structure of message
[alice`s ephemeral public key, MAC tag, ciphertext]
I do not understand what I shoud do if I want to ...
- 248
4
votes
1
answer
2k
views
Why do we use 1024 / 160 bit primes in DSA?
I am looking at DSA's parameter generation and don't understand why for $p$ a 1024 bit prime is needed if $q$ is chosen as a $160$ bit prime. I thought that the security of DSA relates on the discrete ...
- 589
4
votes
1
answer
361
views
Can the security of ECDSA be compromised by the chosen parameters?
The recommended parameters for a secp256k1 ECDSA curve are:
(All values are in hexadecimal)
...
- 195
3
votes
1
answer
423
views
Security of Fast Two-Party ECDSA Signing
The paper "Fast Secure Two-Party ECDSA Signing" by Yehuda Lindell describes a system in which two parties, $P_1$ (with 1/2 of a share of a long-term ECDSA signing key $x_1$) and $P_2$ (with the other ...
- 385
3
votes
2
answers
1k
views
Can I get away with generating 512-bit k (and d) for ECDSA based on P-521?
I've been implementing a hobbyist cryptography library, and I'm at the part where elliptic-curve cryptography is being implemented. I've already implemented and tested ECDSA with P-256 and P-384, ...
- 9,672
3
votes
2
answers
203
views
Given multiple incomplete ECDSA signatures, what can a quantum attacker learn in the following scenarios?
Assume a 256-bit ECDSA private key used with Secp256k1 and SHA-256. This key signs multiple different messages in a fully deterministic manner as described in RFC-6979, so signing the same message ...
- 43
3
votes
1
answer
1k
views
When using ECDSA P-384 for signing and verifying messages, should the public key be also included **INSIDE** the message before signing?
I am using ECDSA P-384 for signing and verifying messages. The messages are basically stringified JSON. After receiving, the recipient verifies the signature using the public key.
Should the public ...
3
votes
1
answer
510
views
What's the problem with ECDSA and SHA-3?
To quote Ilari on the CFRG mailing list:
e.g. the vile mess that is ECDSA with SHA-3
I have some ideas what he might mean but I couldn't find the discussion so what is that mess?
- 4,933
3
votes
0
answers
312
views
How can the Number Field Sieve attack the discrete log in $\mathbb Z_p^*$ of DSA?
The Digital Signature Algorithm (DSA) uses $L$-bit prime $p$ and $N$-bit prime $q$ with $q| p-1$, i.e., $p = r\cdot q +1$ ( Schnorr group if $r>2$ and safe prime if $r=2$).
In a way, the security ...
- 49.3k
3
votes
1
answer
312
views
Appending ECDSA signature to a message
I need to authenticate a message sent to an embedded device (which limits my options in terms of just using an existing convention). I can run ECDH/ECDSA on the device and can use SHA-256 as a hash ...
- 31
3
votes
1
answer
2k
views
Can Montgomery ladder multiplication be used with secp256k1?
While reading about Elliptical Curves and ECDSA, I found a paper ECDSA Security in Bitcoin and Ethereum: a Research Survey by Hartwig Mayer. On page 6, the authors say:
The curve secp256k1 does not ...
- 31
3
votes
2
answers
5k
views
Are ECDSA keys and RSA keys interchangeable?
Is it possible to use an ES512 key pair for RS512 signatures?
Is it possible to use an RS512 key pair for ES512 signatures?
I've also posted an issue in the NodeJS jwa package.
I created a key pair ...
- 309
3
votes
1
answer
784
views
How bad is it to use the identity function as hash for ECDSA?
I was recently asked whether a certain library supports the ECDSAwithNone Signature algorithm. Clearly this would mean ECDSA with the identity function as the hash function. I know this is a really ...
- 46.3k
2
votes
1
answer
593
views
Verifying multiplicative inverse on a prime field in NIST's ECDSA_Prime.pdf
I am trying to learn about the Elliptic Curve Digital Signature Algorithm (ECDSA) by verifying the results in some example calculations. I found a PDF of example ECDSA calculations from NIST here:
...
- 123
2
votes
0
answers
862
views
Elliptic Curve based blind signature implementation [closed]
I want to use Elliptic Curve based blind signature scheme for my research.
There is no proper implementation of ECC-based blind signatures.
Can someone describe to me which things I need to follow ...
- 121
2
votes
1
answer
228
views
Universal forgery based on mathematical problem
It is known that DSA admits universal forgery under assumption that the Attacker can solve the equation $x\equiv R^x\pmod p.$ Are there any other protocols admitting universal forgery based on non-...
- 568
2
votes
1
answer
444
views
Can ECDSA signature signing and verification process replaces password hashed based login system?
ECDSA or DSA in general was to sign a message or data using private key and verify it using public key, if the attacker/imposter doesn't have the private key then they couldn't sign the message ...
- 159
2
votes
3
answers
498
views
ECDSA-SHA256 HTTP Signature String Construction
I must verify an HTTP signature to guarantee the origin and integrity of a webhook data: https://www.blockcypher.com/dev/bitcoin/#webhook-signing
This is their x509 PKIX encoded signing key's public ...
- 33
2
votes
3
answers
1k
views
Digital Signature Algorithm for large files - bottle-necked by hash function?
I am new to studying digital signatures like ECDSA and EdDSA, and was curious about something.
Lets say hypothetically I want to create a digital signatures of millions of files, with a total size of ...
- 153
2
votes
1
answer
3k
views
Where can I find Secp256k1 ECDSA test vectors?
I`m currently implementing an ECDSA library based on curves like secp256k1. I would like to test it using some test vectors, like http://csrc.nist.gov/groups/STM/cavp/documents/dss/ecdsatestvectors....
- 1,679
2
votes
1
answer
93
views
Small subgroup attack when using a Schnorr group for DHKE
One uses a Schnorr group both for Schnorr signature (or DSA), and for Diffie-Hellman Key Exchange. They target 128-bit security, and choose prime $q$ that's 256-bit, prime $p=q\,r+1$ that's 3072-bit, ...
- 144k
2
votes
2
answers
318
views
Can we recover public key from DSA signatures as we can from ECDSA?
I learned the Public Key Recovery algorithm for ECDSA, and wonder if we can use it in DSA. The answer seems to be no, but details are welcome.
- 23
1
vote
0
answers
119
views
Math of Hint usage in Dilithium
For Dilithium, I understand that
$$\text{HighBits}(\mathbf{Ay}) = \text{HighBits}(\mathbf{Ay} - c\mathbf{s_2}) = \text{HighBits}(A_z - c\mathbf{t})$$
The first term of the equation is performed on the ...
- 81
1
vote
1
answer
57
views
Can a quantum attacker prove that incomplete ECDSA signatures were produced with the same key?
Assume a 256-bit ECDSA private key used with Secp256k1 and SHA-256. This key signs multiple different messages in a fully deterministic manner as described in RFC-6979, so signing the same message ...
- 43
1
vote
1
answer
739
views
ECDSA SECP256k1 curve - same-r-value-is-used-for-two-different-addresses
Edited: changing the notation according request by fgrieu.
I have prepared 4 transactions for 2 pubkeys with the same r1 and r2.
properties of secp256k1:
...
- 11
0
votes
0
answers
49
views
Three ECDSA signatures sharing first component r, verifying against same message and public key?
For some common curve, can we exhibit three distinct ECDSA signatures $(r,s_1)$, $(r,s_2)$, $(r,s_3)$, a message $m$, and valid public key $Q$, such that the signatures verify?
Can we also generate ...
- 144k
0
votes
1
answer
2k
views
Key generation in Digital Signature Algorithm
In DSA, one needs to generate two primes $p$ and $q$ such that $q$ is $256$-bit and $p$ is $3072$-bit and $p-1$ is a multiple of $q$.
Question: How to generate such $p$ and $q$.
Attempt: First, use ...
- 491
0
votes
1
answer
1k
views
Can I know from a Bitcoin public key if the private key is odd or even?
Can I know just from a Bitcoin public key if the private key is odd or even?
[moderator note] That is, can we find parity of the private key from a secp256k1 public key?For the original dump of ...
- 11
0
votes
1
answer
375
views
With ECDSA is there a way for the verifier to calculate any properties of $k$?
With ECDSA, given $(r,s)$ and $m$, is there a way for a verifier to calculate any (boolean) properties of $k$, without knowing $k$ or the private key $D_A$?
(I understand that $k$ should be random, or ...
- 649
-1
votes
1
answer
154
views
Is it possible to generate random bits to be imported as a private key and then deducing his public key?
Is it possible to generate random bits (or any bits we decide) to be imported as a private key and then deducting his public key please?
Ideally with a supported Javascript WebCrypto algorithm ( ...
- 51