Questions tagged [dsa]

The Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. It was proposed by the National Institute of Standards and Technology (NIST) in August 1991 for use in their Digital Signature Standard (DSS), specified in FIPS 186, adopted in 1993. A minor revision was issued in 1996 as FIPS 186-1. The standard was expanded further in 2000 as FIPS 186-2 and again in 2009 as FIPS 186-3.

Filter by
Sorted by
Tagged with
9 votes
1 answer
2k views

Simple digital signature example that one could compute without a computer?

I am working on a document to explain Bitcoin to students. But I am having a hard time translating the principle described in §2 of the Bitcoin whitepaper in layman's terms. There is a great question ...
Bob van Luijt's user avatar
8 votes
1 answer
792 views

preferred method for generating k for DSA / ECDSA

FIPS 186-4, sections B.2.1 and B.2.2, discuss two different methods for generating k for DSA / ECDSA. Unless I'm mistaken RFC 6979 discusses another method utilizing HMAC_DRBG. So what method is the ...
neubert's user avatar
  • 2,927
7 votes
1 answer
3k views

ECDSA security using same per-message secrets $k$ but different signing keys

I know that when I have a ECDSA keypair and use it twice with the same $k$ to sign different messages then the private key can be recovered. If I now have multiple ECDSA keypairs and sign a message ...
Markus Knecht's user avatar
7 votes
1 answer
2k views

EdDSA (Ed25519) is any random number sufficient for a good private key?

Looking at a reference implementation it shows that the key pair generation simply does: read X bytes from RNG and then derive another value from these X bytes thus producing private key with derived ...
Alexey Kamenskiy's user avatar
6 votes
1 answer
2k views

Threshold Signatures for RSA and DSA

I have a few questions relating to threshold signatures: a scheme where $n$ participants hold a key share and any $t$ of them can conduct a protocol using their shares that results in a valid RSA or ...
PulpSpy's user avatar
  • 8,627
6 votes
1 answer
799 views

How to properly add ECDSA private keys?

I'm currently working on an application that requires me to add two ECDSA private keys in order to make a new private key. The result has to have the property, that its corresponding public key is the ...
ThePiachu's user avatar
  • 1,679
6 votes
1 answer
12k views

Public-key format for ECDSA as in FIPS 186-4?

What is the public-key format for ECDSA as in FIPS 186-4, and where is it formally defined? In particular, are there variants beyond Cartesian coordinates? Is that a pair of bitstrings, or a ...
fgrieu's user avatar
  • 141k
6 votes
2 answers
2k views

Are curve secp256k1 ECDSA signatures distinguishable from random data?

Are the 64-byte curve secp256k1 ECDSA signatures distinguishable from random data? I.e. Given a random private key and random data, will there be patterns? Is there a proof or reasoning for this?
fadedbee's user avatar
  • 918
5 votes
0 answers
347 views

What public-key encryption protocol can use the same key pair as ECDSA?

Assume we wanted to use the same ECDSA public/private key pair (drawn for standard ECC parameters, perhaps P-256) for both its intended use (public-key signature), and for public-key encryption; this ...
fgrieu's user avatar
  • 141k
5 votes
1 answer
140 views

Consequence of improper validation in point decompression?

Assume a standard ECC curve in a prime field $\mathbb F_p$ with $p\equiv3\pmod 4$, such as secp256k1; and code turning a bytestring for a compressed ECC public key into an Elliptic Curve point, that ...
fgrieu's user avatar
  • 141k
5 votes
1 answer
1k views

In ECDSA, how many field operations are used for signature verification?

I am wondering about the computational cost of ECDSA signature verification, in term of multiplications in the base field; and, as an aside, in term of (much cheaper) additions. To make things ...
fgrieu's user avatar
  • 141k
5 votes
2 answers
4k views

Is there any reason to use RSA or DSA when we have ECC?

I am having trouble coming up with a use case for RSA or DSA. It appears that ECC is better in every way. Is this true? I am looking for cases where RSA/DSA is superior to ECC, not where it is used ...
Demi's user avatar
  • 4,793
4 votes
1 answer
334 views

Can the security of ECDSA be compromised by the chosen parameters?

The recommended parameters for a secp256k1 ECDSA curve are: (All values are in hexadecimal) ...
CCS's user avatar
  • 195
4 votes
1 answer
2k views

Why do we use 1024 / 160 bit primes in DSA?

I am looking at DSA's parameter generation and don't understand why for $p$ a 1024 bit prime is needed if $q$ is chosen as a $160$ bit prime. I thought that the security of DSA relates on the discrete ...
user4811's user avatar
  • 579
4 votes
2 answers
926 views

ECIES with ECDSA

I understand how ECIES work. I have a structure of message [alice`s ephemeral public key, MAC tag, ciphertext] I do not understand what I shoud do if I want to ...
sribin's user avatar
  • 248
3 votes
1 answer
773 views

How bad is it to use the identity function as hash for ECDSA?

I was recently asked whether a certain library supports the ECDSAwithNone Signature algorithm. Clearly this would mean ECDSA with the identity function as the hash function. I know this is a really ...
SEJPM's user avatar
  • 46k
3 votes
2 answers
1k views

Can I get away with generating 512-bit k (and d) for ECDSA based on P-521?

I've been implementing a hobbyist cryptography library, and I'm at the part where elliptic-curve cryptography is being implemented. I've already implemented and tested ECDSA with P-256 and P-384, ...
DannyNiu's user avatar
  • 9,216
3 votes
0 answers
301 views

How can the Number Field Sieve attack the discrete log in $\mathbb Z_p^*$ of DSA?

The Digital Signature Algorithm (DSA) uses $L$-bit prime $p$ and $N$-bit prime $q$ with $q| p-1$, i.e., $p = r\cdot q +1$ ( Schnorr group if $r>2$ and safe prime if $r=2$). In a way, the security ...
kelalaka's user avatar
  • 48.5k
3 votes
1 answer
487 views

What's the problem with ECDSA and SHA-3?

To quote Ilari on the CFRG mailing list: e.g. the vile mess that is ECDSA with SHA-3 I have some ideas what he might mean but I couldn't find the discussion so what is that mess?
Elias's user avatar
  • 4,913
3 votes
2 answers
179 views

Given multiple incomplete ECDSA signatures, what can a quantum attacker learn in the following scenarios?

Assume a 256-bit ECDSA private key used with Secp256k1 and SHA-256. This key signs multiple different messages in a fully deterministic manner as described in RFC-6979, so signing the same message ...
ostrich's user avatar
  • 43
3 votes
2 answers
5k views

Are ECDSA keys and RSA keys interchangeable?

Is it possible to use an ES512 key pair for RS512 signatures? Is it possible to use an RS512 key pair for ES512 signatures? I've also posted an issue in the NodeJS jwa package. I created a key pair ...
Ozo's user avatar
  • 309
3 votes
1 answer
2k views

Can Montgomery ladder multiplication be used with secp256k1?

While reading about Elliptical Curves and ECDSA, I found a paper ECDSA Security in Bitcoin and Ethereum: a Research Survey by Hartwig Mayer. On page 6, the authors say: The curve secp256k1 does not ...
Diego Maü's user avatar
3 votes
1 answer
300 views

Appending ECDSA signature to a message

I need to authenticate a message sent to an embedded device (which limits my options in terms of just using an existing convention). I can run ECDH/ECDSA on the device and can use SHA-256 as a hash ...
user1139455's user avatar
2 votes
1 answer
3k views

Where can I find Secp256k1 ECDSA test vectors?

I`m currently implementing an ECDSA library based on curves like secp256k1. I would like to test it using some test vectors, like http://csrc.nist.gov/groups/STM/cavp/documents/dss/ecdsatestvectors....
ThePiachu's user avatar
  • 1,679
2 votes
2 answers
388 views

ECDSA-SHA256 HTTP Signature String Construction

I must verify an HTTP signature to guarantee the origin and integrity of a webhook data: https://www.blockcypher.com/dev/bitcoin/#webhook-signing This is their x509 PKIX encoded signing key's public ...
Carlos's user avatar
  • 33
2 votes
1 answer
571 views

Verifying multiplicative inverse on a prime field in NIST's ECDSA_Prime.pdf

I am trying to learn about the Elliptic Curve Digital Signature Algorithm (ECDSA) by verifying the results in some example calculations. I found a PDF of example ECDSA calculations from NIST here: ...
David Grayson's user avatar
2 votes
1 answer
68 views

Small subgroup attack when using a Schnorr group for DHKE

One uses a Schnorr group both for Schnorr signature (or DSA), and for Diffie-Hellman Key Exchange. They target 128-bit security, and choose prime $q$ that's 256-bit, prime $p=q\,r+1$ that's 3072-bit, ...
fgrieu's user avatar
  • 141k
2 votes
0 answers
828 views

Elliptic Curve based blind signature implementation [closed]

I want to use Elliptic Curve based blind signature scheme for my research. There is no proper implementation of ECC-based blind signatures. Can someone describe to me which things I need to follow ...
tdumidu's user avatar
  • 121
2 votes
1 answer
3k views

How (in)secure is a signature based on DSA with DSS1 (SHA1) in reality?

As I found out the OpenSSL implementation provided by PHP (openssl_sign) only allows DSS1 as the hashing algorithm for DSA signatures (see also my related question). I’d prefer DSA over RSA in my ...
CodeX's user avatar
  • 263
2 votes
1 answer
226 views

Universal forgery based on mathematical problem

It is known that DSA admits universal forgery under assumption that the Attacker can solve the equation $x\equiv R^x\pmod p.$ Are there any other protocols admitting universal forgery based on non-...
Alexey Ustinov's user avatar
2 votes
2 answers
262 views

Can we recover public key from DSA signatures as we can from ECDSA?

I learned the Public Key Recovery algorithm for ECDSA, and wonder if we can use it in DSA. The answer seems to be no, but details are welcome.
jiegec's user avatar
  • 23
2 votes
0 answers
111 views

Security problems if ECDH and ECDSA use the same key [duplicate]

Hy! I want to use an EC key for ECDH and ECDSA too. Using the same key does compromise the security of the key in a cryptographic / mathematical sense? I read a lot in this theme, but I found nothing ...
Zsolt Czikó's user avatar
2 votes
3 answers
1k views

Digital Signature Algorithm for large files - bottle-necked by hash function?

I am new to studying digital signatures like ECDSA and EdDSA, and was curious about something. Lets say hypothetically I want to create a digital signatures of millions of files, with a total size of ...
user3667125's user avatar
1 vote
1 answer
53 views

Can a quantum attacker prove that incomplete ECDSA signatures were produced with the same key?

Assume a 256-bit ECDSA private key used with Secp256k1 and SHA-256. This key signs multiple different messages in a fully deterministic manner as described in RFC-6979, so signing the same message ...
ostrich's user avatar
  • 43
1 vote
1 answer
634 views

ECDSA SECP256k1 curve - same-r-value-is-used-for-two-different-addresses

Edited: changing the notation according request by fgrieu. I have prepared 4 transactions for 2 pubkeys with the same r1 and r2. properties of secp256k1: ...
Ironic's user avatar
  • 11
0 votes
0 answers
34 views

Three ECDSA signatures sharing first component r, verifying against same message and public key?

For some common curve, can we exhibit three distinct ECDSA signatures $(r,s_1)$, $(r,s_2)$, $(r,s_3)$, a message $m$, and valid public key $Q$, such that the signatures verify? Can we also generate ...
fgrieu's user avatar
  • 141k
0 votes
1 answer
369 views

With ECDSA is there a way for the verifier to calculate any properties of $k$?

With ECDSA, given $(r,s)$ and $m$, is there a way for a verifier to calculate any (boolean) properties of $k$, without knowing $k$ or the private key $D_A$? (I understand that $k$ should be random, or ...
Thomas Von Panom's user avatar
0 votes
1 answer
2k views

Key generation in Digital Signature Algorithm

In DSA, one needs to generate two primes $p$ and $q$ such that $q$ is $256$-bit and $p$ is $3072$-bit and $p-1$ is a multiple of $q$. Question: How to generate such $p$ and $q$. Attempt: First, use ...
Idonknow's user avatar
  • 491
0 votes
1 answer
897 views

Can I know from a Bitcoin public key if the private key is odd or even?

Can I know just from a Bitcoin public key if the private key is odd or even? [moderator note] That is, can we find parity of the private key from a secp256k1 public key?For the original dump of ...
Md shimul's user avatar
-1 votes
1 answer
143 views

Is it possible to generate random bits to be imported as a private key and then deducing his public key?

Is it possible to generate random bits (or any bits we decide) to be imported as a private key and then deducting his public key please? Ideally with a supported Javascript WebCrypto algorithm ( ...
lakano's user avatar
  • 51

1
2